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ABSTRACT 


A substantial challenge to reducing security gaps in the international air cargo supply 
chain is the lack of a method of evaluating existing levels of risk based upon points of 
origin, points of departure and cargo and aircraft type. This is particularly challenging 
since the current United States air cargo security protocol requires the 100 percent 
screening of all air cargo without objectively analyzing or evaluating the risk posed by 
the air cargo. 

This thesis proposes a risk-based intelligence driven approach to identify and 
mitigate the threat of the successful introduction of an improvised explosive device into 
the international air cargo supply chain. The primary thrust of this research effort is to 
conduct a comparative analysis of the United States international air cargo policies and 
the European Union’s international air cargo policies as a means of evaluating and 
proposing a risk based intelligence driven international air cargo policy that capitalizes on 
the strengths of United States and European Union’s systems. 
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EXECUTIVE SUMMARY 


A. INTRODUCTION 

As noted in numerous government and industry reports, the current international 
application of the congressionally mandated 100 percent air cargo screening requirement 
is currently unattainable. A portion of the problem with the implementation of the 
mandate is the inability of the Transportation Security Administrations (TSA) to enforce 
air cargo screening requirements beyond the U.S. territorial borders. Additionally, if the 
jurisdictional authority existed, the infrastructure necessary to meet the 100 percent 
security screening requirements as required by the Aviation Transportation Security Act 
(ATSA) simply does not exist within the international air cargo supply chain. The 
administration’s regulatory capabilities, while sufficient for domestic enforcement, fall 
short of what would be required to enforce administrative screening requirements in 
foreign nations. 

To that end, in March 2012, Customs and Border Protection (CBP) and the TSA 
created a pilot program known as the Air Cargo Advanced Screening (ACAS) program 
with the intent of leveraging the capabilities of each agency. 1 The goal of this pilot 
program was to streamline the processes and procedures for the advanced screening of 
international air cargo through the collection and analysis of shipping and shipper data. 
The objective of this data collection was to create a “trusted shipper” and “trusted 
shipment” system that could be combined with the information available in CBP’s 
automated targeting system. While this process provides an opportunity for CBP and the 
TSA to ensure shippers have been vetted prior to providing cargo for shipment by 
aircraft, it does not allow the TSA or CBP to establish effectively the level of risk the 
cargo or its point of origin may present to the aircraft. 2 While these programs and 
administrative advances are beneficial, the failure to apply a risk-based and intelligence 


1 U.S. Customs and Border Patrol Transportation Security Administration, Air Cargo Advanced 
Screening Pilot Strategic Plan, March 2012. 

2 Ibid. 
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driven protocol designed to target shippers, shipments, points of origin, and regions that 
pose the greatest threat to air cargo still needs to be addressed. 


B. PROBLEM STATEMENT 

Exploring the issues surrounding international air cargo security is as important as 
ever. The cost of a successful attack on the commercial aviation system that results in a 
seven-day shutdown of commercial aviation would be between $248 billion to $394 
billion during the two-year recovery period resulting from the attack, according to the 
Center for Risk and Economic Analysis of Terrorism Events at the University of 
California. For the past three decades, terrorists have actively attempted to exploit 
weaknesses in the aviation industry as a means of weakening the U.S. economy and 
causing fear in society. Specifically, terrorist organizations have regularly targeted U.S. 
citizens and its economy by attempting to detonate explosive devices on passenger and 
cargo aircraft. As quoted in the November 2010 special edition of Inspire magazine, and 
reported by A1 Jazeera, A1 Qaeda stated, “We are laying out for our enemies’ our plan in 
advance because as we stated earlier our objective is not maximum kill, but to cause 
[damage] in the aviation industry, an industry that is so vital for trade and transportation 
between the US and Europe.” These attacks and attempted attacks have regularly 
involved the use of improvised explosive devices (IEDs). In an analysis conducted by the 
Homeland Security News Wire after the Boston Marathon bombings, it was determined 
by START “that IEDs were the most common weapons used in the 207 terrorist plots and 
attacks in the United States from 2001 to 2011.” In the past three decades, terrorists have 
sought to disrupt the U.S. economy by attacking aviation. While the most successful of 
these attacks involved hijacking, the most consistent means of attack involved the 
attempted detonation of IEDs on aircraft. 

As policies and technologies were introduced to counter the IED threat, terrorists 
have shifted the means of introducing an IED onto an aircraft. They have now focused on 
the vulnerabilities that exist in the air cargo environment. Prior to the attacks that 
occurred on September 11, 2001, the Federal Aviation Administration (FAA) was 
responsible for aviation security and had implemented a number of recommendations, 
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mandates, and security directives to improve modern aviation security starting in 1990. 
After each of these attacks, the FAA and now the Transportation Security Administration 
(TSA) attempted to institute security directives that would detect, deter, or prevent future 
attacks. Existing regulations, policies, and procedures were reviewed and amended to 
meet the evolving threat. In certain instances, Congress stepped in and passed legislation 
designed to close real and perceived gaps in aviation security. One of these legislative 
solutions was the 100 percent air cargo-screening requirement, which was passed in 
2007. In each instance, the improved processes failed to detect or prevent the future 
attacks. 


C. RESEARCH QUESTIONS 

The primary question this thesis addressed is can a multi-layered, intelligence- 
driven air cargo security protocol be developed from existing programs to decrease the 
threat posed by a cargo-borne incendiary device or IED? 

In addition, this thesis considered the following questions. How can the TSA in 
collaboration with CBP better apply risk categories to the international air cargo 
screening requirements to decrease the probability of a successful terrorist attack on air 
cargo? Which programs are suited to this collaboration, which systems create 
unnecessary redundancies, and do new programs need to be established? 

This thesis attempted to confirm the following suppositions. 

• A risk-based international air cargo screening protocol provides the 
flexibility necessary to adjust to the changing threats and the technological 
advancements in the air cargo industry. 

• A risk-based international air cargo screening protocol will provide the 
adaptability necessary to adjust to the threat environment based on the 
associated risks rather than treating all threat environments as equal. 

• A risk-based international air cargo screening protocol will provide a 
sustainable security process while simultaneously meeting the needs of the 
air cargo industry. 

D. ANALYSIS 

A comparative analysis of the processes and producers applied by the European 
Union (EU) was conducted to evaluate the practicality of using a risk-based intelligence 
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driven air cargo security screening process that accounts for differences in vulnerabilities 
while additionally creating a universal framework that can be applied over several 
differing jurisdictions. To this point, the requirements imposed by the European upon the 
member states are not dissimilar from those that the TSA imposes on known shippers in 
the United States. The polices of the European Union and the United States diverge when 
risk and consequence are inserted into the security equation by the European Union as a 
means of mitigating risk. The application of a risk and consequence-based security 
protocol, as seen in the EU application of varying security requirements dependent of 
class of aircraft, is in direct conflict with the regulatory requirement imposed on the TSA 
by the congressionally mandated 100 percent air cargo screening process. 

E. RECOMMENDATIONS 

This thesis makes the following recommendations and assertions. 

• A risk-based intelligence driven process for the screening of international 
air cargo should be developed and implemented for application prior to the 
introduction of air cargo into the global supply chain. This process would 
be designed with the intention of enhancing air cargo security without 
overwhelming the aviation industry with unrealistic goals and 
expectations. 

• A risk assessment methodology would be applied to air cargo and mail 
security that recognizes that different portions of the supply chain are 
subject to varying security strengths and vulnerabilities, and as such, do 
not represent an equal levels of risk. 

• The current 100 percent air cargo security screening process fails to 
recognize these differences, and is both cumbersome to the industry, and 
an inefficient use of valuable security and law enforcement resources. 
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I. INTRODUCTION 


A. PROBLEM SPACE 

Exploring the issues surrounding international air cargo security is as important as 
ever. The cost of a successful attack on the commercial aviation system that results in a 
seven-day shutdown of commercial aviation would be between $248 billion to $394 
billion during the two-year recovery period resulting from the attack, according to the 
Center for Risk and Economic Analysis of Terrorism Events at the University of 
California. 1 For the past three decades, terrorists have actively attempted to exploit 
weaknesses in the aviation industry as a means of weakening the United States economy 
and causing fear in society. Specifically, terrorist organizations have regularly targeted 
U.S. citizens and its economy using explosive devices on passenger and cargo aircraft. As 
quoted in the November 2010 special edition of Inspire magazine and reported by A1 
Jazeera, A1 Qaeda stated, “We are laying out for our enemies’ our plan in advance 
because as we stated earlier our objective is not maximum kill, but to cause [damage] in 
the aviation industry, an industry that is so vital for trade and transportation between the 
US and Europe.” 2 These attacks and attempted attacks have regularly involved the use of 
improvised explosive devices (IEDs). In an analysis conducted by the Homeland Security 
News Wire after the Boston Marathon bombings, it was detennined by START “that 
IEDs were the most common weapons used in the 207 terrorist plots and attacks in the 
United States from 2001 to 2011.” 3 In the past three decades, terrorist have sought to 
disrupt the U.S. economy by attacking aviation. While the most successful of these 
attacks involved hijacking, the most consistent means of attack involved the attempted 
detonation of IEDs on aircraft. 


1 Peter Gordon, “The Economic Impacts of a Terrorist Attack on the U.S. Commercial Aviation 
System,” Create Homeland Security’ Center at the University of Southern California, October 1, 2005, 
http://create.usc.edu/research/50796.pdf. 

2 ALJAZEERA, “Al-Qaeda Wing to Target US Economy,” November 21, 2010, http://www.aljazeera. 
com/news/middleeast/2010/11/2010112110484673847.html. 

3 Homeland Security News Wire, “IEDs Growing Threat in U.S., Security Experts,” April 17, 2013 
http://www.homelandsecuritynewswire.com/dr20130417-ieds-a-growing-threat-in-u-s-security-experts. 
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• On 12 December 1988, an explosive device was placed on Pan American 
flight 103, which detonated in the cargo hold and caused a terminal failure 
of the aircraft structure. The attack succeeded in killing 243 passengers, 16 
crew members and 11 residents of Lockerbie Scotland where large 
sections of the fuselage landed. 4 

• On 22 January 1995, Ramsey Yousef conspired to place explosives on 10 
American flagged commercial passenger aircraft bound for North America 
with the intent of causing simultaneous catastrophic airframe failures over 
the Pacific Ocean. 5 

• On 22 December 2001, Richard Reid attempted to detonate an explosive 
device hidden in his shoe on American Airlines flight 63 while over the 
Atlantic Ocean. 6 

• On 24 August 2004, Satsita Dzhebirkhanova and Amanta Nagayeva 
successfully detonated concealed IEDs on two separate aircraft in a 
coordinated attack that killed 90 people. 7 

• On 24 December 2009, Farouk Abdulmutallab attempted to detonate an 
IED secreted in his underwear on Northwest flight 253 while over the 
United States. 8 

• On 3 September 2010, Al-Qaeda in the Arabian Peninsula claimed 
responsibility for a attack on a Boeing 747-44AF (SCD) cargo plane, 
registered N571UP, which was destroyed in an accident shortly after 
takeoff from Dubai Airport (DXB), UAE. Both crewmembers were killed 
in the crash. 9 

• On 29 October 2010, Al-Qaeda in the Arabian Peninsula (AQAP) shipped 
two explosive devices by aircraft, which were discovered in separate cargo 
aircraft bound for the United States. These explosives were set to explode 
while in flight over the United States. 10 


4 Washington Post, “The Bombing of Pan Am Flight 103,” 1999, http://www.washingtonpost 
.com/wp-srv/inatl/longterm/panaml 03/timeline.htm. 

5 CNN, “Plane Terror Suspects Convicted on All Counts,” September 5, 1996, http://www.cnn.com/ 
US/9609/05/terror.plot/. 

6 CNN, “Exchange Between Reid Judge, Follows Life Sentence,” December 6, 2003, http://www.cnn. 
com/2003/LAW/01/30/shoebomber. sentencing/. 

7 Associated Press, “Russia Plane Crashes Caused by Explosives,” August 30, 2004, http://www.nbc 
news.com/id/5810127/ns/world_news/t/russia-plane-crashes-caused-explosives/#.UlBkZRaPCZY. 

8 David Ariosto and Deborah Feyerick, “Christmas Day Bomber Sentenced to Life in Prison,” CNN, 
February 17, 2012, http://www.cnn.com/2012/02/16/justice/michigan-underwear-bomber-sentencing. 

9 ALJAZEERA, “Al-Qaeda Wing to Target US Economy.” 

I® The Telegraph, “Ink Cartridge Bomb Reveals Innovation of Terrorist Group,” October 30, 2010, 
http://www.telegraph.co.uk/news/uknews/terrorism-in-the-uk/8098587/Ink-cartridge-bomb-reveals- 
innovation-of-terrorist-groups.html. 
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As policies and technologies were introduced to counter the IED threat, terrorists 
have shifted the means of introducing an IED onto an aircraft. They now focus on the 
vulnerabilities that exist in the air cargo environment. Prior to the attacks that occurred on 
September 11, 2001, the Federal Aviation Administration (FAA) was responsible for 
aviation security and had implemented a number of recommendations, mandates, and 
security directives to improve modern aviation security starting in 1990. 11 After each of 
these attacks, the FAA and now the Transportation Security Administration (TSA) 
attempted to institute security directives that would detect or prevent future attacks. 
Existing regulations, policies, and procedures were reviewed and amended to meet the 
evolving threat. In certain instances, Congress stepped in and passed legislation designed 
to close real and perceived gaps in aviation security. One of these legislative solutions 
was the 100 percent air cargo-screening requirement, which was passed in 2007. In each 
instance, the improved processes failed to detect or prevent the future attacks. 

While airport passenger screening is the sole responsibility of the TSA, aviation 
cargo screening is a fractured system that involves the TSA, Customs and Border 
Protection (CBP), private corporations, freight forwarders, and shippers. These diverse 
stakeholders, each of who have separate goals that are not complementary—industry 
seeking profit and government seeking regulation—create vulnerabilities that continue to 
present aviation security challenges. Industry in the form of the aviation industry, freight 
forwarders, and shippers seek the most efficient and cost effective means of delivering 
products. Government, which is represented by the TSA and CBP, are focused on 
preventing successful attacks on this nation’s aviation industry with little regard for the 
security measures’ costs or the burdens placed on industry. David Widdowson and 
Stephen Holloway stated in a World Customs Journal article about transport security 
regulation, “many government responses to the international security threat merely lead 
to an increase in the regulatory burden on honest traders” without enhancing the security 


11 U.S. Government Accountability Office, Report to Congressional Requesters, Aviation Security, 
Vulnerabilities and Potential Improvements for the Air Cargo System (GAO-03-344), Washington, DC: 
GPO, 2002, http://www.gao.gov/products/GAO-03-344. 
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of high-risk shipments. 12 This vulnerability is further exacerbated by the inability of the 
TSA and CBP to regulate international air cargo bound for the United States. This 
vulnerability was highlighted in Congressional testimony when Pennsylvanian 
Congressman Charles Dent stated in his 2010 testimony before the Committee on 
Homeland Security that “TSA has no clear plan in place to address foreign in-bound 
cargo, thought the law requires it. Why is that? Not for a lack of effort, but because of a 
lack of authority.” 13 The current international air cargo screening processes are 
reminiscent of those that existed in the airport passenger-screening environment prior to 
September 11, 2001. The system relies on the industry acceptance, third-party contractor 
application, and regulatory enforcement to ensure the appropriate screening procedures 
are applied. 

The TSA through the Aviation Transportation Security Act (ATSA) is tasked with 
regulating the screening of passengers and cargo. 14 This requirement is further codified 
in 49 CFR Part 1542-Airport Security, which outlines the regulatory relationship 
between the TSA and airport operators. 15 Cargo operations are regulated under 49 CFR 
Part 1544.205-Acceptance and Screening of Cargo, which states that aircraft operators 
are responsible for preventing the carriage of explosives in cargo onboard aircraft and 
how this should be accomplished. 16 It is this ambiguous screening requirement, which is 
further defined in 49 CFR Part 1548-Indirect Air Carrier Security, that creates the 


12 David Widdowson and Stephen Holloway, “Maritime Transport Security Regulation: Policies, 
Probabilities and Practicalities,” World Customs Journal 3, no. 2 (2009), http://www.internationaltrans 
portfomm.org/2009/fomm2009.html. 

13 Charles Dent, ‘TOO Percent Air Cargo Screening: Remaining Steps to Secure Passenger Aircraft, 
Hearing before the Subcommittee on Transportation Security and Infrastructure Protection,” 2010, 
http://www.gpo.gov/fdsys/pkg/CHRG-l 1 lhhrg64699/html/CHRG-l 1 lhhrg64699.htm. 

14 Govytrack.us., “S. 1447 (107th): Aviation and Transportation Security Act,” 2001, http://www. 
govtrack.us/congress/bills/107/s 1447. 

15 U.S. Government Printing Office, “49 CFR Part 1542-Airport Security,” 2010, http://www.gpo. 
gov/fdsys/granule/CFR-2010-title49-vol9/CFR-2010-title49-vol9-part 1542/content-detail.html. 

16 U.S. Government Printing Office, “49 CFR Part 1544.205-Aircraft Operator Security: Air Carriers 
and Commercial Operators,” 2010, http://www.gpo.gov/fdsys/granule/CFR-2010-title49-vol9/CFR-2010- 
title49-vol9-partl544/content-detail.html. 


4 



greatest vulnerability in air cargo operations by allowing 89 independent cargo screening 
facilities to certify the safety of air cargo while remaining subject to inspection by 
approximately 400 transportation security inspectors. 17 

Since its creation, the TSA has mandated increased industry security measures 
around cargo facilities and aircraft through the use of security directives that target these 
vulnerable assets. As an example, Transportation Security Inspectors (TSI) have 
increased cargo inspections, explosive detection canine teams have been added at airport 
cargo facilities, and training programs for air cargo workers have been created. 18 The 
TSA has additionally moved beyond the airport cargo preparation and receiving areas and 
is currently using over 1,200 facilities located outside airport properties for industry- 
supported cargo screening through the Certified Cargo Screening Program (CCSP). 19 

The Administration’s regulatory capabilities, while sufficient for domestic 
enforcement, fall short of what would be required to enforce administrative screening 
requirements in foreign nations because of an inability of the Administration to enforce 
these requirements effectively in the international arena. This inability makes 
implementing and regulating the 100 percent air cargo-screening requirement 
problematic outside the U.S. jurisdictional boundaries. This weakness, which is shared by 
CBP, has been exploited by narcotics, human, and counterfeit merchandise smugglers, 
and remains the weakest link in the air cargo transportation chain. The TSA and CBP 
continue to seek administrative solutions to air cargo screening problems that reach 
beyond the authority granted to the administration. 


17 U.S. Government Printing Office, “49 CFR Part 1548-Indirect Air Carrier Security,” 2002, 
http://www.ecfr.gov/cgi-bin/text-idx?c=ecfr;sid=c60b3377d4eaafad4feeec6cd8f29983;rgn=div5;view= 
text;node=49 percent3 A9.1.3.5.13 ;idno=49;cc=ecfr. 

18 Transportation Security Administration, “Kip Hawley Assistant Secretary, Transportation Security 
Administration; Testimony to the Subcommittee on Homeland Security Committee on Appropriations,” 
2008, http://www.tsa.gov/press/speeches/testimony_archives.shtm. 

19 Transportation Security Administration, “Certified Cargo Screening Program,” n.d., http://www. 
tsa.gov/certified-cargo-screening-program. 
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To that end, in March 2012, CBP and the TSA created a pilot program known as 
the Air Cargo Advanced Screening (ACAS) program with the intent of leveraging the 
capabilities of each agency. 20 The goal of this pilot program was to streamline the 
processes and procedures for the advanced screening of international air cargo using data 
collection. The objective of this data collection was to create a “trusted shipper” and 
“trusted shipment” system that could be combined with the data available in CBP’s 
automated targeting system. While this process provides an opportunity for CBP and the 
TSA to ensure shippers have been vetted prior to providing cargo for shipment by 
aircraft, it does not allow the TSA or CBP to establish effectively the level of risk the 
cargo or its point of origin may present to the aircraft. 21 While these programs and 
administrative advances are beneficial, the failure to apply a risk-based and intelligence 
driven protocol designed to target shippers, shipments, points of origin, and regions that 
pose the greatest threat to air cargo still needs to be addressed. As noted by the 
Government Accountability Office (GAO) in 2011, “TSA currently uses a risk informed 
approach to schedule foreign airport assessments by categorizing airports into three 
tiers.” 22 These tiers would additionally be utilized to identify air cargo shippers and 
shipments that should be the emphasis of the ACAS system to ensure the most efficient 
use of the limited security resources. 

As previously noted, the exceptional economic cost of a successful attack on 
aviation makes these assets an attractive target for terrorists. Additionally, the fact that by 
2008 counter-terrorism spending had increased by $15 billion over conventional counter 
threat spending on all other crime and the economic impact this spending has on the 
United States, should not be ignored. 23 This type of impact is precisely what A1 Qaeda 
seeks. To this point, A1 Qaeda stated in November 2010 in the third edition of Inspire 

20 U.S. Customs and Border Patrol Transportation Security Administration, Air Cargo Advanced 
Screening Pilot Strategic Plan, March 2012. 

21 Ibid. 

22 U.S. Government Accountability Office, Aviation Security; TSA Has Taken Steps To Enhance Its 
Foreign Airport Assessments, but Opportunities Exist to Strengthen the Program (GAO-12-163), 
Washington, DC: GPO, 2011. 

23 Veronique de Rugy, “The Economics of Homeland Security,” in Terrorizing Ourselves: Why U.S. 
Counterterrorism Policy Is Failing and How to Fix It, ed. Benjamin H. Friedman, Jim Harper, and 
Christopher A. Preble (Washington, DC: Cato Institute, 2010), 123. 
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magazine, “In terms of time it took us three months to plan and execute the operation 
from beginning to end. On the other hand this supposedly ‘foiled plot’, as some of our 
enemies would like to call it, will without a doubt cost America and other Western 
countries billions of dollars in new security measures.” 24 In the years following the 
attacks on 9/11 TSA implemented a layered approach to aviation security, which includes 
21 different layers depicted below that were designed to detect and deter a successful 
terrorist attack on an aircraft. 


Layers of U.S. Aviation Security 



Figure 1. Layers of U.S. Aviation Security 25 


In the 11 years since the attacks of September 11, 2001, private industry, the 
FAA, and the TSA have attempted to procure a technological or develop a regulatory 
solution to the threat of an IED on an airplane. In his opening remarks to Congress, 

24 Al-Malaham Media, “Special Issue,” Inspire Magazine no. 3 (November 2010), http://ia600304.us. 
archive.org/28/items/INSPIRE_ISSUE_3/special.pdf. 

25 Transportation Security Administration, “Layers of Security” n.d., http://www.tsa.gov/about- 
tsa/layers-security. 
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Stephen M. Lord, the Director of Homeland Security and Justice Issues from the GAO, 
stated, “In the almost 10 years that have passed since TSA assumed responsibility for 
aviation security, TSA has spent billions of dollars and implemented a wide range of 
initiatives to strengthen the layers of aviation security. However, risks to the aviation 
system remain.” 26 Numerous protocols, regulations, and detection equipment have been 
deployed with the intention of mitigating this threat. Despite the significant investment of 
time and money, to date, none of these solutions has been completely successful, as 
evidenced by the successful IED attack perpetrated by AQAP on October 28, 2010. 
While combining the capabilities and administrative authorities of the TSA and CBP is a 
good start, the inability of these agencies to capitalize on and leverage the data they 
already possess to improve the current system by applying a risk-based intelligence 
driven air cargo protocol needs to be addressed. 

B. RESEARCH QUESTIONS 

The primary question this thesis addressed is, can a multi-layered, intelligence- 
driven air cargo security protocol be developed from existing programs to decrease the 
threat posed by a cargo-borne incendiary or IED? 

In addition, this thesis considered the following questions: How can the TSA in 
collaboration with CBP better apply risk categories to the international air cargo 
screening requirements to decrease the probability of a successful terrorist attack on air 
cargo? Which programs are suited to this collaboration; which systems create 
unnecessary redundancies, and do new programs need to be established? 

This thesis attempted to confirm the following suppositions. 

• A risk-based international air cargo screening protocol provides the 
flexibility necessary to adjust to the changing threats and the technological 
advancements in the air cargo industry. 


26 U.S. Government Accountability Office, Testimony Before the Subcommittee on National Security, 
Homeland Defense, and Foreign Operations, Committee on Oversight and Government Reform, House of 
Representatives, Aviation Security, TSA Has Taken Actions to Improve Security, but Additional Efforts 
Remain, Statement of Stephen M. Lord, Director Homeland Security and Justice Issues (GAO-11-807T), 
2011, http ://www.gao.gov/products/GAO-11-807T. 
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• A risk-based international air cargo screening protocol will provide the 
adaptability necessary to adjust to the threat environment based on the 
associated risks rather than treating all threat environments as equal. 

• A risk-based international air cargo screening protocol will provide a 
sustainable security process while simultaneously meeting the needs of the 
air cargo industry. 

C. RESEARCH METHOD 

This thesis is a policy analysis project. According to Bardach, policy analysis 
contains eight steps, which include defining the problem, assembling evidence, 
constructing alternatives, and selecting evaluation criteria, projecting the outcomes and 
confronting the tradeoffs, and detennining the best course of action. This project is based 
upon and uses the methodological framework established by Bardach. 27 The policies 
being researched and evaluated are the congressionally mandated 100 percent 
international air cargo screening requirement, the European Union (EU) regulatory 
framework as applied to the implementation of EU regulation 1082/2012Y in respect to 
aviation security validations and the proposed risk-based intelligence driven international 
air cargo screening protocol. The specific aspects of those polices researched are the 
availability and reliability of data and intelligence, jurisdictional hurdles for 
implementation and enforcement, the measurement and application of risk, as well as the 
government and industry incurred cost. 

The criteria used to analyze and develop recommendations for each of these 
polices researched were selected after a review of the available industry and govermnent 
literature and testimony. The literature and available industry and government testimony 
determined the path of the research as previous polices, recommendations, and proposed 
solutions to the threat of explosives on aircraft were analyzed over the two and a half 
decades preceding the successful air cargo attack in 2010. 

The research was broken into three sections. The first section evaluated the data 
and literature as it pertains to the pre-9/11 period of aviation security with an emphasis on 
the period after an IED attack on Pan Am flight 103. This period of time provides insight 

27 Eugene Bardach, A Practical Guide for Policy’ Analysis (Washington, DC: CQ Press College, 2011). 
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into the evolving threat of terrorism and terrorist organizations’ emphasis on aviation 
attacks. During this period, the Gore commission and the associated GAO reports 
identified many of the jurisdictional and cost challenges faced by the FAA for 
implementing international aviation security. These challenges primarily focused on the 
jurisdictional conflicts, implementation costs, the unpredictability of terrorist attacks, and 
the lack of actionable intelligence. These limitations were used as a means of framing the 
research and served as means of evaluating the practicality of implementing each of the 
three processes. The two consecutive periods of research included the post-9/11 period 
and the time frame after the successful air cargo attack in October 2010. Aviation 
security was continuously evolving during each of the periods, and the policies and 
practices implemented were evaluated. At the conclusion of this policy evaluation, a clear 
understanding of the issues and problems related to the application of a 100 percent 
international air cargo screening protocol was achieved and an alternative solution was 
developed. 

D. CHAPTER OVERVIEW 

As outlined in Chapter I, the introductory chapter, the focus of this thesis was to 
explore the feasibility of continuing the 100 percent air cargo screening protocols as 
required by Congress, and inversely, exploring the possibility that a risk-based 
intelligence driven process could be established from existing programs that would 
increase the resiliency and sustainability of international air cargo security. 

Chapter II provides an overview of the gaps in the international air cargo security 
practices, and the necessity for the creation of a risk-based intelligence driven air cargo 
screening protocol. This chapter additionally examines what has worked and what has not 
worked as a means of mitigating this threat to date. 

Chapter III provides a review of literature related to the international air cargo 
environment. This chapter establishes the basis for understanding the literature and 
research that has been generated based on three periods of emphasis. These three periods 
include the pre-9/11 literature as it relates to international air cargo, the post-9/11 
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literatures, and the literature that has been written since the printer toner attacks that 
occurred in October 2010. 

Chapter IV discusses and evaluates the U.S. international air cargo security 
protocols, as well as the EU international air cargo protocols, and the use and availability 
of air cargo data and intelligence and its limitations. 

Chapter V discusses and evaluates the jurisdictional hurdles faced by each of the 
three systems. Each system is evaluated according to the legal authority the 
administrating agency has to implement and enforce the applicable security processes. 

Chapter VI evaluates the costs associated with the implementation of the United 
States 100 percent air cargo security screening requirement, the EU implementation of 
EU regulation 1082/2012, and the application costs associated with the proposed risk- 
based intelligence driven air cargo security protocol. This chapter discusses and evaluates 
the cost to industry and government. 

Chapter VII provides an outline of the proposed policy changes and their 
implementation in international air cargo security systems. This chapter discusses the 
plausibility, process, and benefits of instituting the proposed policy changes, particularly 
in contrast to those aspects of the congressionally mandated 100 percent air cargo 
screening process. This chapter concludes with a discussion of the limitations of the 
research. 


11 



THIS PAGE INTENTIONALLY LEFT BLANK 


12 



II CHALLENGES 


A. AIR CARGO GAP ANALYSIS 

As previously discussed, both industry and government have been unable to find a 
suitable solution to the threat of an IED attack on the aviation industry. In particular, 
preventing an IED attack using air cargo has been a acutely difficult problem to solve. 
This difficulty was underlined by the successful air cargo attack and the medias focus on 
the United States failure to close known security gaps as highlighted by the article by 
Nick McMaster in Figure 2. As a result of the lack of an efficient process to secure air 
cargo, Congress implemented the 100 percent air cargo screening mandate. While this 
mandate was well intentioned and the steps taken to attempt to implement it have 
improved air cargo security, the unintended fiscal consequences and jurisdictional gaps of 
the mandate currently make implementation impractical if not impossible. This chapter 
evaluates the procedures and programs that have been developed, as well as the gaps that 
continue to exist. 



US Knew of, Didn't Close 
Air Cargo Security Gaps 

Nov S. 2.0tQ 7:45 Ah* C£T 

Figure 2. Cargo Bomb Was Set to Blow Up over the United States 28 


28 Nick McMaster, “Cargo Bomb Was Set to Blow Up Over US,” November 10, 2010, 
http://www.newser.eom/tag/55738/l/eargo-bombs.html. 
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In the 17 years since the discovery of the Bojinka plot, private industry, the FAA, 
and now the TSA, have consistently attempted to develop a technological or procedural 
solution to the threat of an IED on an airplane. In a 2011 GAO report, Stephen Lord, the 
Director of Homeland Security and Justice Issues, is quoted as saying, “In the almost 10 
years that have passed since TSA assumed responsibility for aviation security, TSA has 
spent billions of dollars and implemented a wide range of initiatives to strengthen the 
layers of aviation security. However, risks to the aviation system remain.” 29 Numerous 
protocols, regulations and detection equipment have been deployed with the intention of 
mitigating this threat. Of note is the most recent iteration in the governmental quest for a 
regulatory solution to the air cargo vulnerability. In 2007, Congress passed the ATSA, a 
portion of which seeks to address the air cargo screening vulnerability by mandating the 
implementation of the 100 percent air cargo screening initiative. This initiative requires 
that all cargo placed on passenger aircraft must receive the same level of screening to 
which passengers and baggage are subject. Despite the significant investment of time and 
money, none of these solutions, to include the 100 percent air cargo-screening 
requirement, have been completely successful. 

The greatest air cargo vulnerability remains the inability to extend the TSA and 
CBP’s administrative authority beyond the U.S. border effectively to mitigate the benefits 
that an effective and regulated 100 percent air cargo-screening protocol would create. 
Each agency’s regulatory capabilities, while sufficient for domestic enforcement, fall 
short of what would be required to enforce administrative screening requirements in 
foreign nations. Charles Dent noted in his 2010 testimony before Congress, “TSA has no 
clear plan in place to address foreign in-bound cargo, thought the law requires it. Why is 
that? Not for a lack of effort, but because of a lack of authority.” 30 This weakness, which 
has been exploited by narcotics, human and counterfeit merchandise smugglers for 
centuries, remains the weakest link in the air cargo transportation chain. The TSA and 

29 U.S. Government Accountability Office, “Testimony Before the Subcommittee on National 
Security, Homeland Defense, and Foreign Operations, Committee on Oversight and Government Reform, 
House of Representatives,” Aviation Security, TSA Has Taken Actions to Improve Security, but Additional 
Efforts Remain Statement of Stephen M. Lord, Director Homeland Security and Justice Issues.” 

30 Dent, “100 Percent Air Cargo Screening: Remaining Steps to Secure Passenger Aircraft, Hearing 
before the Subcommittee on Transportation Security and Infrastructure Protection.” 
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CBP continue to seek administrative solutions to air cargo screening problems that reach 
beyond the authority granted to each of these agencies. Additionally, the congressionally 
imposed requirement for the TSA to screen 100 percent of air cargo is equally 
unenforceable or attainable. Dent stated in 2010 that the “success of a 100 percent 
screening requirement will depend in part on an effective inspection and enforcement 
program—we cannot simply impose a requirement and declare victory.” 31 Unfortunately, 
because the administrative and regulatory authority of CBP and the TSA ends at the U.S. 
border, a 100 percent screening protocol is conceptually ineffective. 

A significant amount of research has been conducted at the industry and 
government levels, but academia has not yet attempted to conduct a complete analysis of 
the three decades’ worth of data available. 


31 Dent, “100 Percent Air Cargo Screening: Remaining Steps to Secure Passenger Aircraft, Hearing 
before the Subcommittee on Transportation Security and Infrastructure Protection.” 
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III. LITERATURE REVIEW 


It is generally agreed among industry and government subject matter experts that 
the international air cargo supply chain remains vulnerable despite the 30-year pursuit for 
an answer to this aviation security gap. This is illustrated by the below figure which 
depicts a small portion of the numerous stakeholders involved in the air cargo security 
enterprise. 


Millions of 
Known 
Shippers 



- 4,100 
* Indirect 
Air Carriers 



-300 Air 

Carriers 



Air Cargo Environment Overview 


Figure 3. Air Cargo Environment Overview 32 


Legislative measures, international agreements, and technological solutions have 
been sought and unsuccessfully applied to this problem. Much of the research conducted 
in response to this weakness has come from government sources, such as the GAO, 
Congressional Research Service (CRS), and the Department of Homeland Security Office 
of the Inspector General (DHS/OIG). The Congressional Committee on Homeland 
Security has held hearings and received testimony from industry and agency leaders on 
air cargo screening. The scope of this literature review includes documents that pertain to 
air cargo security during the pre-9/11, the post-/911, and the post-10/29 AQAP printer 
toner attack. 

The pre-9/11 literature includes Ramsey Yousefs Bojinka plot, in which the 
radical Islamist was able to design and test an explosive device capable of evading 
detection during the passenger screening process. The intended use of this device was to 
conduct a coordinated attack on U.S. flagged passenger air carriers that would destroy 10 
passenger aircraft as they were flown over the Pacific Ocean while traveling to the United 
States. This period additionally includes the Libyan sanctioned terrorist attack on Pan Am 

32 Transportation Security Administration, “Air Cargo, Office of Security Policy and Industry 
Engagement,” last revised January 9, 2013, http://www.tsa.gov/stakeholders/air-cargo. 
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flight 103, which was destroyed by an explosive device secreted within the baggage hold 
of the aircraft. These two attacks were the focus of the 1996 Gore Commission’s report 
and findings on aviation security for the core of the decade’s worth of available literature 
on the subject of aviation security. 

The second period of study covers the post-9/11 literature developed in response 
to the hijacking and subsequent destruction of four U.S. flagged air carriers. While air 
cargo security is discussed during this period, it is ancillary to the discussion of passenger 
screening and anti-hijacking technologies, techniques, and counter measures. The 
predominate theory during this 10-year period was that terrorists would attempt to either 
hijack an all-air-cargo aircraft as a means of recreating the 9/11 attacks, or that terrorists 
would attempt to smuggle an IED onto an air passenger carrier as was seen during the 
2006 liquid bomb plot, and the 2009 Christmas day attempted underwear bombing. 

The third period of review covers the literature created after the Yemen printer 
toner attack disrupted by Saudi Arabian intelligence on October 28, 2010. It is during this 
three-year period that a significant shift is seen in the aviation security literature with a 
renewed emphasis towards the screening of domestic and international air cargo. It is in 
the post printer toner attack period that the 100 percent air cargo screening protocol was 
created by Congress with the intention of improving aviation security. Much of the 
literature during this time frame discusses implementation deadlines, as well as technical 
and operational obstacles to successful implementation. 

A search for the available literature was conducted using the search terms aviation 
security, air cargo, air cargo security, and international air cargo security along with risk 
and risk mitigation. This search resulted in the discovery of a significant amount of 
government testimony, analysis, and reports. These products include CRS and GAO 
reports, Congressional testimony and industry sponsored papers designed to analyze the 
air cargo industries’ vulnerabilities and to seek and evaluate proposed solutions. 
Government and industry entities with a direct interest in air cargo security and its 
economic and operational impact produce the majority of the literature and research. The 
review has been organized according to three distinct historical periods corresponding to 
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terrorist activities that impacted the evolution of aviation security: the pre-9/11 period, 
the post-9/11 period, and the post-AQAP Printer Toner Air Cargo attack period. 


A. PRE-9/11 ATTACKS 

1. International Air Cargo 

The available literature and studies are primarily government sponsored and 
congressionally mandated analysis. They show a consistent understanding of the urgency 
of the problem and the necessity to address these vulnerabilities. What the pre-9/11 
literature lacks is a comprehensive solution to the risk posed by international air cargo 
carried on all cargo and all passenger aircraft. While the government experts and 
committees were consistently able to point to flaws in the system and the necessity to 
ensure these vulnerabilities are addressed, a comprehensive solution to the problems that 
balanced the needs of industry and government were not presented primarily because of 
the lack of a specific and credible threat to the industry. Additionally, the tremendous 
jurisdictional and implementation costs, which still exist today, made government and 
industry acceptance improbable. 

GAO noted in 1994 that the FAA would need to balance regulatory oversight of 
the industry without impeding commerce or creating competitive complications to 
improve the nation’s aviation security systems. 33 As a result, the FAA established the 
position of federal security manager at domestic category X airports and security liaison 
officers at international locations to serve as the FAA’s representative to law 
enforcement, security and airport/airline mangers. According to the air carriers, despite 
the FAA’s attempt to balance commerce and security, the necessity for U.S. airlines to 
comply with the more stringent requirements imposed by the FAA while operating 
internationally, place a greater financial obligation on the U.S. carriers and puts them at a 
competitive disadvantage. 34 A 1990 study conducted by the Department of 
Transportation was unable to detennine if the competitive disadvantage exited. Similarly, 

33 U.S. Government Accounting Office, Aviation Security, Additional Actions Needed to Meet 
Domestic and International Challenges (GAO/RCED-94-38), Washington, DC: GPO, January 1994, 
http://www.gao.gov/products/RCED-94-38. 

34 Ibid. 
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the FAA stated that it recognized that these differences existed and while they had not 
studied the subject, they did not believe a disadvantage existed. 35 The 1994 GAO report 
concluded that the introduction of new measures and technology in the coming decades 
must be done in a way that does not adversely affect commerce and the industry. 36 The 
GAO addressed several of the programs created in response to the Aviation Security Act 
of 1990 and focused a large part of its auditing efforts on cargo carried on passenger 
aircraft. 37 The GAO stated that the FAA had made progress in designing and 
implementing steps to identify airfreight forwarders as a means of improving air cargo 
security awareness, but The GAO also found that the FAA had not developed an 
inspection strategy to ensure regulatory compliance. 38 The GAO stated that the success 
of the freight forwarder program relied upon a robust and effective inspection process 
and that the lack of such a program created vulnerabilities. 39 

Two years after that report, Keith O. Fultz, the Assistant Comptroller General, 
Resources, Community and Economic Development Division, GAO, stated in his 
testimony before the Congressional Subcommittee on Aviation that the threat of a 
terrorist attack on American aviation had increased, and significant vulnerabilities to the 
system continued to exist both domestically and internationally. 40 Of note was the threat 
of the introduction of explosives to aircraft by passengers, baggage, mail, and cargo. At 
the time of this testimony, the FAA considered the introduction of explosives through 
checked baggage the greatest threat to aviation, the threat of unauthorized access to 
restricted areas of the airport and checked baggage being the next greatest threats. Fultz 
further noted that the ability to screen cargo and mail at airports was very difficult 


35 PolicyFutures, “Report of the Presidents Commissions on Aviation Security and Terrorism,” May 
15, 1990, http://www.policyfutures.com/PCAST/PCASTreport.pdf, 34. 

36 Ibid. 

37 Ibid. 

38 Ibid. 

39 Ibid. 

40 U.S. General Accounting Office, Testimony Before the Subcommittee on Aviation, Committee on 
Transportation and Infrastructure House of Representatives, Aviation Security, Urgent Issues Need to Be 
Addressed, Statement of Keith O. Fultz, Assistant Comptroller General, Resources, Community, and 
Economic Development Division (GAO/T-RCED/NSAID-96-251), Washington, DC: GPO, 1996. 
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because of the size and scope of the system and the unpredictability of terrorism. Fultz 
raised two questions during his testimony, whether aviation security should be considered 
an issue of national security, and who should be responsible for paying for the costs 
associated with enhancing the air security process. 41 Fultz further discussed technological 
capabilities in his testimony to the Congressional Committee on Science and again noted 
the urgent need for the FAA, intelligence communities, and industry representatives to 
decide what actions needed to be taken and who would pay for it. 42 

2. Pre-9/11 Risk 

Prior to the attacks on 9/11, the federal government and private industry were 
using risk and vulnerability assessments as a means of allocating limited resources to 
sectors that faced the greatest probability of attack or failure. In 1988, the GAO reported 
on several acts that Congress had passed as compared to the practices of several private 
industries. 43 Several challenges were noted, two of which focused on the intelligence 
community, specifically, the inability of the intelligence community to share valid and 
specific intelligence to end users who would then be able to adjust their security posture 
to limit the risk associated with the threat. 44 The report additionally focused on the 
difficulty associated with the necessity of both industry and government to provide a 
thorough evaluation of large sectors whose scope, magnitude, and complexity made such 
comprehensive evaluations difficult if not impossible to validate. 45 

The FAA Reauthorization Act of 1996 (Public Law 104-264), established the 
requirement for the FAA and Federal Bureau of Investigations (FBI) to conduct Joint 
Vulnerability Assessments (JVA) with the intent of measuring each airport’s 

41 U.S. General Accounting Office, Testimony Before the Subcommittee on Aviation, Committee on 
Transportation and Infrastructure House of Representatives, Aviation Security, Urgent Issues Need to Be 
Addressed, Statement of Keith O. Fultz, Assistant Comptroller General, Resources, Community, and 
Economic Development Division. 

42 Ibid. 

43 U.S. General Accounting Office, Report to Congressional Requesters, Combating Terrorism, 

Threat and Risk Assessments Can Help Prioritize and Target Program Investments (NSIAD-98-74), 
Washington, DC: GPO, April 1998. 

44 Ibid. 

45 Ibid. 
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vulnerabilities and level of risk. 46 Each risk assessment evaluated proposed scenarios that 
the intelligence communities could validate or determine as unlikely based on available 
domestic and foreign intelligence. The teams used to conduct these JVAs consisted of 
risk, security, and vulnerability subject matter experts and were employees of the FBI and 
FAA. 

In contrast to the government process, the private industries interviewed for the 
report conduct tri-annual assessments using teams of experts, of which no more than 25 
percent could be experts in security. The industries’ stated intention of limiting the 
number of security experts to 25 percent was to ensure that a diverse assessment, which 
focused beyond the security vulnerabilities, was created that would better identify the 
unpredictable risks a team of security experts would not see. 

In 1998, the GAO conducted a comparative analysis of the private sector’s five- 
step risk assessment process to the joint FAA and FBI system as was mandated by the 
Federal Aviation Reauthorization Act of 1996. While the joint FAA and FBI system 
relied on an annual evaluation and assessment of the vulnerabilities of category X 
airports, it did not include an evaluation of the probability of such attacks successfully 
occurring. 

As previously stated, the public sector oil company analyzed utilized a five-step 
process that included the following evaluation criteria. 

1. Determine the value of assets and judge the consequences of the loss of 
those assets 

2. Identify the threats and pair them with the assets 

3. Identify the assets vulnerabilities 

4. Determine risks through the application of scenarios 

5. Identify actions as necessary that lead to risk reduction 47 


46 U.S. General Accounting Office, Report to Congressional Requesters, Combating Terrorism, 
Threat and Risk Assessments Can Help Prioritize and Target Program Investments. 

47 Ibid. 
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In contrast to the manner in which the FAA and FBI conducted risk and threat 
assessments, the oil company gathered a diverse group of subject matter experts and 
identified vulnerabilities and actions to be taken to mitigate the risk the vulnerability 
created. 48 

The congressional budget for fiscal year 2001 for combating terrorism was set at 
$11 billion. 49 This funding level was in a large part established through the evaluation of 
the industry and governmental vulnerabilities and the intent of known terrorist 
organizations. While the intent of a terrorist organization is a reasonable indicator of a 
risk, the GAO report established the capability of the terrorist organization to conduct the 
intended attack as a better determinant of where perceived versus actual risks exist. 50 In 
2000, federal efforts were focused on vulnerabilities rather than analyzing the credibility 
of the threat caused by the identified vulnerabilities. In 2000, the intelligence 
communities assessed that explosives and firearms were the preferred weapons of 
terrorists and posed the greatest risk. Since these assessments were the tools used for 
prioritizing the government’s counter-terrorism investments, in 2001, the government 
focused on these threats. 51 

In contrast to the manner in which the United States establishes vulnerabilities 
and risk, the GAO evaluated five foreign countries policies and practices for establishing 
risk and allocating limited resources. These countries included in the report were Canada, 
France, Germany, Israel, and the United Kingdom. The GAO found in report NSAID-00- 
85, that the countries studied allocated their resources based on the likelihood of threats 
becoming attacks based on the available intelligence. Unlike in the United States, the 
intelligence communities of the five countries evaluated would continuously assess the 


48 U.S. General Accounting Office, Report to Congressional Requesters, Combating Terrorism, 
Threat and Risk Assessments Can Help Prioritize and Target Program Investments. 

49 U.S. General Accounting Office, Testimony Before the Subcommittee on National Security, 
Veterans Affairs, and International Relations, Committee on Government Reform, House of 
Representatives, Combating Terrorism, Linking Threats to Strategies and Resources Statement of Norman 
J. Rabkin, Director National Security Preparedness Issues National Security and International Affairs 
Division (GAO/NSIAD-OO-218), Washington, DC: GPO, 2000. 

50 Ibid. 

51 Ibid. 
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threats to determine which ones posed the greatest risk-based on the probability of them 
occurring. The countries would then assign assets to counter the risk from sectors at a 
lesser risk of attack by having used the risk and threat assessments as a means of 
prioritizing budgetary allocations. 52 

B. POST-9/11 ATTACKS 

1. International Air Cargo 

Since the attacks on September 11, 2001, groups within the U.S. government have 
completed numerous reports and evaluations of the existing vulnerabilities in the aviation 
security and the air cargo supply chain. The GAO (2002) provided testimony before the 
U.S. Senate Committee on Commerce, Science and Transportation outlining the 
immediate and long-term challenges that the TSA would face while preparing to secure 
the nation’s transportation systems. Dr. Gerald L. Dillinham, the Director of Physical 
Infrastructure Issues, GAO noted during his testimony that securing the nation’s aviation 
systems would be a difficult task, in particular, the need to meet mandated deadlines 
while creating a federal agency. 53 At the time of his testimony in 2002, two bills 
designed to address identified deficiencies in the air cargo supply chain, S. 2656 and S. 
2668, were pending ratification by the U.S. Senate. S. 2656 required the head of the TSA 
to establish a security plan for the transportation of cargo in and out of the United States. 
S. 2668 required the head of the TSA to establish a system to screen cargo in all 
passenger and cargo aircraft. Neither bill came to the floor for a vote, but rather, each was 
read and referred to the Committee on Commerce, Science and Transportation for further 
discussion. 

According to the 2002 GAO report on Vulnerabilities and Potential Improvements 
for the Air Cargo System of 2002, the FAA and TSA failed to develop a comprehensive 
plan for eliminating vulnerabilities in the air cargo system as had been identified and 

52 U.S. General Accounting Office, Report to Congressional Requesters, Combating Terrorism, How 
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recommended by the 1990 Gore Commission. 54 The failure of the TSA to identify and 
eliminate these vulnerabilities had the potential to threaten the air transport system. The 
TSA’s focus on securing passenger and baggage screening was identified as a significant 
contributing factor for this failure. The GAO noted that while the TSA had made progress 
in passenger and baggage screening, it had failed to develop a comprehensive plan and 
long-term goals for air cargo security. 55 

The TSA and CBP released the Air Cargo Strategic Plan in 2003, which was 
designed to provide a road map for both agencies to implement threat-based, risk- 
managed strategies to the air cargo environment. 56 The TSA and CBP stated that the 
release of the plan was intended to address issues raised in the GAO report of December 
2002 and the Department of Transportation’s Office of the Inspector General report from 
September 2002. Despite developing an air cargo security plan designed to manage the 
various risks in the air cargo environment, the TSA also acknowledged that successfully 
accomplishing such a task would be difficult. 57 

As noted by the GAO in 2005, the TSA had begun to take steps towards securing 
the air cargo supply chain by applying a risk-based strategy to assess vulnerabilities by 
beginning to focus on two specific air cargo threats. The threats identified were the 
possible introduction of an explosive device on a passenger aircraft and the hijacking of 
an all-cargo aircraft. These priorities were consistent with TSA’s 2003 Air Cargo 
Strategic Plan. Some air cargo industry leaders agreed with the TSA’s use of the two 
identified threats, but other air cargo specialist noted that a gap existed in the air cargo 
threat assessment outlined in the Air Cargo Strategic Plan. Specifically, the industry 
stakeholders were concerned with the failure of the TSA to recognize the threat of an 
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explosive device being placed on an all-cargo aircraft. 58 The TSA addressed these 
concerns with the GAO in 2005 by stating, “TSA decided to focus on the two threats 
cited above because they are the most likely to occur.” 59 

A report to Congress by the CRS in 2007 noted that the air cargo system 
continued to be vulnerable to terrorist plots involving the placement of explosives in 
passenger and all cargo aircraft. The 110th Congress clarified the processes required to 
properly screen air cargo in the Implementing the 9/11 Commission Recommendations 
Act of 2007 (H.R.l). Specifically, the act required 100 percent of air passenger cargo be 
screened with the equivalent process used to screen passengers and checked baggage. 
Industry stakeholders and leaders argued that this provision was not a practical solution 
and that it would present significant costs and challenges for the air cargo industry. David 
Wirsing of the Airforwarders Association stated that the cost would be “over 700 million 
dollars in the first year alone,” while TSA spokeswoman Andrea McCauley placed the 
10-year cost estimate at $3.6 billion. 60 A subsequent CRS analysis placed the cost at 
$3.75 billion over the same decade. 61 

In 2007, the Homeland Security Council (HSC) published the National Strategy 
for Homeland Security in which it described the possibility of terrorist agents exploiting 
the global supply chain to smuggle weapons of mass destruction into the United States 
and create catastrophic events. GAO highlighted in 2007 that the two agencies 
responsible for the security of international air cargo, the TSA and CBP, had begun to 
implement inbound air cargo security protocols, but also noted that CBP and the TSA had 
failed to establish goals and time frames for fully implementing the processes. Of 
particular note in the GAO report was the failure of the TSA and CBP to establish open 
communication regarding each agency’s air cargo security efforts, intelligence and 
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technology developments. The GAO supported this view, which noted that TSA officials 
acknowledged that vulnerabilities continued to exist in both the international and 
domestic air cargo supply chains, and that the TSA did not have the necessary screening 
and compliance resources needed to eliminate these supply chain vulnerabilities. 62 

The GAO noted in 2008 that while the TSA had made progress in securing the air 
cargo supply chain, programs that had been developed to ease the burden on the shipping 
industry had created new vulnerabilities within the air cargo supply chain. It was noted 
that the TSA had sought to balance the need for commerce and security by providing 
industry-screening exemptions in the domestic and international air cargo processing. 63 
The TSA stated that it used a threat and vulnerability assessment to detennine which 
cargo to exempt, but the GAO stated that the TSA had a limited ability to make realistic 
risk-based exemptions and doing so increased vulnerabilities in the air cargo supply 
chain. According to a 2009 DHS/OIG report, programs developed by the TSA to prevent 
the terrorist and criminal exploitation of the air cargo security supply chain, such as the 
Known Shipper Program (KSP), had failed. 64 This evaluation was supported by 
DHS/OIG, which conducted an audit of the KSP and the Known Shipper Management 
System (KSMS), and found that significant technical and procedural issues remained 
within the systems, and that these issues created unnecessary vulnerabilities within the 
domestic and international air cargo supply chain. 65 

In September 2010, the DHS/OIG published an unclassified summary of the TSA 
procedures for screening air cargo on passenger aircraft. The DHS/OIG spoke to the 
strengths and weaknesses of the explosive trace detection, X-ray, physical search, and 
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ISA-certified canine teams. The DHS/OIG also provided the TSA with a list of the 
vulnerabilities that the audit had detected and that TSA acknowledged that weaknesses in 
the global air cargo supply chain continue to exist. 66 


2. Post-9/11 Risk 

In the post-9/11 records dealing with risk, three elements have become a part of 
the evolution of the risk equation. In GAO-02- 150T, the tools for measuring these 
elements were identified as threat assessments, vulnerability assessments, and criticality 
assessments. The predominant thought in the post 9/11 world was that while risk cannot 
be eliminated, it can be reduced and each assessment provided an opportunity to measure 
risk. Vulnerability assessments are used to identify weaknesses, criticality assessments, 
identify assets, and threat assessments measure the intent and capability of nefarious 
operators. 67 

In February 2007, CRS documented the evolution of the DHS risk measuring 
methodology beginning with 2002 in report RL33858. At the start of this evolution, a 
maturing of the risk evaluation process, and subsequently, the equation, is beginning to 
be seen. Initially, the risk equation detennined that R (risk) = P (population). 68 Over 
time, as the risk assessment process matured, the equation began to contain more 
variables. In 2004-2005, the risk equation became R = T (threat) + Cl (critical 
infrastructure) + PD (population density). 69 It further evolved through 2007 to become 
the now familiar R=TxV (vulnerability) x C (consequence). 70 The application of 
“geographically-based risk” is discussed during this period as well. Geographically based 
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risk considers several characteristics, such as regionally reported threats, as well as law 
enforcement investigations and activity. In addition to these factors, geographically based 
risk analysis considers the vulnerability factors of the region and the impact of an attack 
on the area. 71 The CRS did note that despite the evolution of the risk equation, the value 
of the threat was limited to the available federal investigative and intelligence 
information. 72 

In his 2008 discussion paper, Robert Poole reviewed the application of risk 
models to aviation security, and concluded that at the time, the majority of the 
governmental risk-based discussions were simply rhetoric, stating, “much of the actual 
policy changes appear to have been driven by political imperatives to reassure frightened 
populations that air travel is still safe.” 73 Poole continued to note that since 2005, the 
TSA had made very few attempts to move to a risk-based approach to aviation security, 
and that the failure of the DHS and the TSA to establish or apply an integrated risk 
protocol had also been noted by the GAO in August 2007. 74 In his conclusion, Poole 
discussed the fact that most aviation security and safety polices are the results of attacks 
or accidents, and as such, do not seek solutions to possible future terrorist attacks. 75 In a 
RAND paper designed to evaluate the Department of Homeland Security as it approached 
its first change in executive power since its inception, Brian Jackson and David Frelinger 
noted that it was not possible to respond to all threats without causing unnecessary 
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economic damage. 76 Instead, a cost effective and sustainable security model should be 
designed that does not ignore the novel risks and threats. 77 


C. POST-PRINTER-TONER ATTACK 

1. International Air Cargo 

On October 29, 2010, an operative from AQAP delivered two packages 
containing explosive devices with timers to the UPS and FedEx processing centers in 
Yemen. Information provided by the Saudi Arabian intelligence service assisted in the 
detection of the devices before detonation. 

In December 2010, the CRS published “Screening and Securing Air Cargo: 
Background Issues for Congress,” which highlights policies and processes that were 
being employed by the TSA and CBP. Of note were the TSA’s continued efforts to work 
with international partners to increase international air cargo screening and their 
continued inability to accomplish the congressionally mandated 100 percent air cargo¬ 
screening mandate. The CRS described several obstacles inhibiting the TSA’s ability to 
comply with the mandate. These obstacles included the lack of the regulatory authority to 
define foreign screening requirements, an inability to enforce screening requirements 
developed by the TSA, and a lack of industry support for the cost-ineffective 100 percent 
screening mandate. As a result, the TSA and CBP had begun to institute a risk-based 
inspection strategy. 

In addition, the CRS noted that the Implementing the 9/11 Commission 
Recommendations Act of2007 had defined what processes would not quality as air cargo 
screening, but failed to designate who was responsible for conducting the screening. 78 As 
a result, the TSA placed the requirement for conducting air cargo screening on the 
airlines, freight forwarders, shippers, manufacturers, and third party screening facilities. 
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The TSA cited a lack of assets available for conducting the screening operations as the 
reason for shifting the responsibility for screening. The GAO further supported this in 
2011 while highlighting the TSA’s failed efforts to conduct foreign all air cargo airport 
threat assessments. It was stated that the TSA was unable to establish reasonable goals 
and target completion dates for conducting threat assessments at the 17 air cargo 
international hubs due to the lack of the necessary TSA manpower, funding, and 
authority. 

The DHS published the joint CBP/TSA Air Cargo Advanced Screening Pilot 
Strategic Plan in March 2012. 79 The strategic plan outlines the process proposed by CBP 
and the TSA to identify and screen high-risk air cargo shipments without impeding the 
flow of commerce. CBP and the TSA stated that the pilot process would establish a tiered 
six-stage implementation process with the intention of expanding the trusted shipper 
concept as a means of achieving the 100 percent air cargo-screening mandate. The GAO 
in 2012 reviewed the steps that the TSA had taken to address vulnerabilities to the air 
cargo supply chain. 80 The GAO found that vulnerabilities continued to exist in AC AS 
implementation due to regulatory limitations in the international air cargo environment. 
Additionally, screening vulnerabilities had been highlighted by the failure of the existing 
explosives detection technology to discover the devices used in the Yemen attack. 

The GAO determined that the air cargo industry was unwilling to endure the 
disruptions in the supply chain caused by the rapid lifting of screening exemptions to 
cargo classes and that the TSA had not accounted for the necessity to allow time for the 
industry to adapt to the new processes and procedures. These changes additionally caused 
industry confusion about the appropriate screening process, which then caused lapses in 
air cargo screening protocols. The GAO noted that the TSA continued to encounter 
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challenges and obstacles to meeting the 100 percent air cargo screening protocol and had 
to postpone the implementation of the mandate continuously. 

2. Post-Printer-Toner Attack Risk 

In 2012, the RAND Homeland Security and Defense Center conducted an 
independent assessment of the TSA’s risk management analysis tool used to simulate 
terrorist behavior and the probability of successful attacks on the domestic commercial 
air system. RAND detennined that the model is significantly dependent on identification, 
validation, and maintenance of the approximately 4,300 input valuations through the 
continued use of subject matter expert data, but despite this, the system was a significant 
improvement over the previously rudimentary system employed by the TSA. 81 RAND 
determined that the TSA needed to adopt risk evaluation polices capable of covering a 
broad range of evolving risks rather than creating programs that addressed singular 
threats. 82 
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IV. RISK 


Risk analysis has played a role in the industry and governmental decision 
processes for a significant period of time. The application of risk models to air cargo 
screening protocols is a natural progression of the security industry as this nation moves 
further away from the attacks on 9/11. The necessity to employ the limited resources 
available to government and industry effectively and efficiently, as opposed to continuing 
the implementation the 100 percent air cargo screening protocol, requires the adoption of 
an intelligent risk-based process. The risk analysis and mitigation cycle includes five 
major components: Identify the risk, assess the risk, create a mitigation plan and 
implement the plan while ensuring clear communication. This chapter explores these 
options and the feasibility of applying the risk analysis and mitigation cycle as it would 
apply to the United States, the European Union, and the proposed air cargo screening 
policy. 



Figure 4. Risk Analysis and Mitigation Cycle 83 


At the heart of this discussion is the failure of the 100 percent air cargo security 
requirement to consider the importance of including risk as a factor in the evaluation of 
the threat presented by international air cargo. Just as not all passengers present an equal 
risk to aircraft, not all air cargo poses an equal risk to aircraft. The TSA has recently 
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adopted Risk Based Passenger Screening through the implementation of initiatives 
designed to improve aviation security by concentrating security-screening efforts on 
those passengers who pose the greatest potential risk to the aviation industry, which has 
been accomplished through the adoption of several risk assessing programs. These 
programs include the highly publicized Pre/, screening of active duty U.S. service 
members, managed inclusion and the over 75 and fewer than 12 provisions. 84 This 
chapter discusses the risk assessment processes, or the lack thereof, used in the United 
States and the European Union air cargo security environment used as a means of 
applying the appropriate security screening process to air cargo shipments. 

Within the United States, domestic air cargo transported on passenger aircraft is 
required to be screened at a level commensurate with the level of screening provided to 
passenger baggage. 85 In accordance with the Implementing Recommendations of the 9/11 
Commission Act of 2007, the 100 percent screening process for domestic cargo on 
passenger aircraft was to be completed by August 2010. To meet this requirement, the 
TSA implemented a multi-layered approach for the vetting and screening of domestic 
cargo shipments in the air cargo supply chain. Several programs were established or 
enhanced as a means of maximizing the reliability of this layered security approach. They 
include but are not limited to CCSP, Certified Cargo Screening Facility (CCSF), the 
Indirect Air Carrier (IAC) Program, the IAC Management System and the Know Shipper 
Program. These programs form the core of the TSA domestic air cargo security system. 

The CCSP was created as a means of allowing industry to screen piece level cargo 
prior to its being delivered to the air carrier with the intent of meeting the 100 percent 
screening requirements, which was additionally done to accomplish the screening 
requirement without placing the entire responsibility on the air carriers who do not have 
the capacity to provide the appropriate level of screening to meet the mandate. 86 The 
CCSP is a voluntary program that allows the TSA to assess, validate, and regulate CCSFs 
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that will conduct air cargo screening prior to the cargo being delivered to the air carrier. 
The CCSF piece level screening allows screened and palletized cargo to be uploaded to 
passenger aircraft without further inspection unless risk-based or randomized screening is 
performed. The CCSP is regulated by the TSA. As such, the associated CCSF is subject 
to inspection by Transportation Security Inspectors-Cargo (TSI-C) who ensure regulatory 
and program compliance. 

IACs are “engaged indirectly in the air transportation of property on aircraft” and 
are subject to TSA inspection at any time. 87 Additionally, the TSA uses the Indirect Air 
Carrier Management System (IACMS) to validate and approve existing and new IACs. 
The IACMS process was developed as a means for the TSA to gather pertinent 
information about IACs around the country and assists in the performance of Security 
Threat Assessments (STA) conducted on employees of the companies. The next security 
layer in the TSA air cargo security process is the KSMS created for shippers who did not 
want to become IACs. This security process allows known shippers based within the 
United States to be verified and certified as legitimate shippers by the TSA, which is 
accomplished after a systematic risk assessment and determination of legitimacy is made 
by the TSA. As of the third quarter of 2008, the TSA had processed 1.4 million shippers 
through the KSMS. 

The TSA has resources within the domestic air cargo security regulatory 
framework as well. One of these programs includes the explosive detection canines 
employed in the air cargo security venue. Theses canines are employed specifically to 
clear bulk air cargo to be uploaded onto passenger aircraft at the nation’s busiest 
airports. 88 In addition to being trained as a canine officer, the handlers are fully certified 
transportation security inspectors capable of looking for regulatory violations. 

The IAC Screening Technology Pilot is a pilot program available within the TSA, 
which is an initiative established as a means of allowing high volume air cargo 
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transporters to test screening technology provided by the TSA in an air cargo 
environment as a means of gathering data on the technology’s validity. While these 
security layers provide a robust system for the detection and deterrence of explosives in 
air cargo within the borders of the United States, they are incapable of providing a similar 
layer of security for inbound international air cargo. 

The significant difference between the U.S. and the EU regulations is that the EU 
regulations state that allowances must be made for individual airports “in the light of the 
local risk assessment.” 89 This statement is distinctly different from the federalized 
security system that has been implemented within the United States. Unlike the 
regulatory guidance provided by the European Union, the United States created an all 
hazards process that does not allow for distinctions between the varying levels of risk 
associated with conveyances, points of departure, or passenger and package threats. 
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V. DATA AND INTELLIGENCE EVALUATION 


Data and intelligence gathering and evaluation are often the subject of public 
debate. The real and perceived abuses of private industry and government agencies and 
the privacy violations caused by these abuses make the discussion of expanding these 
types of programs difficult. While the illicit gathering of data is a real issue, this chapter 
looks to explore the feasibility and practicality of gathering and analyzing voluntarily 
supplied industry data and information. 

The use of public and commercial shipping data and intelligence products as a 
means of mitigating risk has been the subject of debate from early on in aviation 
antiterrorism discussions. So much so that in 1990, the Aviation Security Improvement 
Act Congress established the necessity for the FBI and FAA to conduct joint 
vulnerability assessments at all the nation’s largest airports as means of identifying 
vulnerabilities, and ultimately, as a vehicle for reducing risk by designing solutions to 
these vulnerabilities. 90 This chapter discusses the role of voluntarily provided shipping 
data and intelligence in the current U.S. domestic air cargo model, the EU air cargo 
model, and the proposed international air cargo model. 

A. THE U.S. AIR CARGO SYSTEM 

The TSA is exclusively responsible for regulating the handling and security of 
domestic air cargo. As a means of accomplishing this task, it has implemented several 
programs that leverage data collection as a way of mitigating the threat of a domestic air 
cargo attack. As a part of this process, the TSA created a multi-layered data collection 
process that allows for the evaluation of parties interested in participating in the air cargo 
industry. While a majority of these data collection efforts relies on the voluntary 
submission of business and employee information, the ability to participate in the 
aviation industry is contingent on this voluntary data submission. 
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The first tier of data collection in this multi-layered system is the Indirect IAC 
program. This program allows those persons or entities within the United States who do 
not have a FAA air carrier certificate to indirectly participate in the transportation of 
property on passenger air carriers. 91 The IACMS and the KSMS support this program by 
validating new and existing IACs. This database allows companies to voluntary submit 
corporate and employee information, which is used to mitigate the threat of a terrorist 
attack by keeping potentially dangerous applicants and business owners out of the 
aviation industry. Specifically within the air cargo industry, this process is accomplished 
by conducting an aviation worker STA, as depicted in the below figure, for employees 
who want to be employed in the aviation industry by processing and shipping air cargo. 


Enrollment_ 

Applicants pay an enrollment fee and submit biographic (name, address, etc.) and biometric information, 
as applicable by program (photo, if applicable, and fingerprints) to TSA. 


Transportation Worker Identification 
Credential (TWIC): 

Applicant provides biographic and biometric 
information at one of 136 TWIC enrollment 
centers. Information routed and screened on 
TSA Consolidated Screening Gateway system. 


Hazardous Materials Endorsement (HME): 

Depending on the state from which an application 
is being made, applicant provides biographic and 
biometric information to either TSA enrollment 
sites or state-designated sites, which transmit 
applications to TSA. Information routed and 
screened on TSA Screening Gateway system. 


Aviation Worker: 

Applicant provides biographic and biometric 
information to airport operator Airport operator 
submits information to TSA. Information routed 
through TSA Designated Aviation Channeler 
program and screened on TSA Consolidated 
Screening Gateway system.* 


_ Adjudication Center security threat assessment process 


Automated - 
vetting 


Potentially 

derogatory 

results 


■ No potentially derogatory results 


Quality assurance 
process to identify 
adjudicator errors 


Initial review of 
background check 
results by 
contractor 
adjudicators to 
determine 
credential eligibility 


“No threat" determination, 
applicant eligible for 
credential 
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All denials reviewed by 
mid- and senior-level 
adjudicators 


Unfavorable 


O 


Preliminary determination 
of ineligibility letter sent 
to applicant 

Applicant may not be eligible 
for credential 


May seek redress 6 


TWIC 

TSA issues TWIC 
to applicant. 

HME 

State licensing agency 
issues HME to applicant 

Aviation Worker 

Airport issues access 
badge to employee. 



Source: GAO analysis of TSA information. 

Figure 5. TSA Functions in Security Threat Assessment Process 92 
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As an additional means of securing the air cargo industry, the KSMS was created. 
The KSMS system is a platfonn that again allows for the voluntary submission and 
collection of shipper information as a means of validating the legitimacy of a shipper. 
According to data provided by the TSA, as of the third quarter of 2008, the TSA had 
vetted 1.4 million shippers through the KSMS system. 93 A KSMS participant is granted 
the ability to deliver cargo for transport on an aircraft to a CCSP participant. The CCSP is 
required and able to verify the known shipper’s information in the KSMS, and after 
having successfully verified the validity of the shipper, is then allowed to accept the 
shipment for security screening and eventual shipment on air passenger aircraft. 

The TSA and its Office of Intelligence (TSA-OI) are responsible for the collection 
and appropriate dissemination of intelligence products to transportation stakeholders. 
While the TSA-OI does not gather intelligence, it does receive information from the 
Intelligence Community (IC) that it uses for threat analysis. The TSA-OI also gathers 
information from outside the IC. These information sources include components of DHS, 
local law enforcement agencies, as well as industry and transportation sector owners and 
operators. 94 The TSA-OI creates intelligence products shared throughout the 
transportation network as a means of improving domain and threat awareness. The TSA’s 
regulatory division also uses these products, which is responsible for using the 
information for determining the necessity of instituting Security Directives (SD) to U.S. 
transportation system owners and operators as a means of mitigating risks in the 
transportation systems. 

The TSA’s multi-layered system of data collection, intelligence products, and 
threat assessments works well within the United States as a means of mitigating the risks 
associated with the transportation of domestic air cargo. Although the data collection is 
voluntary, it is necessary for companies and employees to provide the information if they 
wish to remain a competitive member of the shipping industry by using passenger 
carrying aircraft. Unfortunately, once cargo goes beyond the borders of the United States, 
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94 Mark A. Randol, The Department of Homeland Security Intelligence Enterprise, Operational 
Overview and Challenges for Congress, CRS Report R40602 (Washington, DC: Library of Congress, 
Congressional Research Service, March 19, 2010), http://www.fas.org/sgp/crs/homesec/R40602.pdf. 
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the system becomes ineffective. Since the TSA does not have the jurisdictional authority 
to enforce the application of regulations by foreign nations and corporations, it is not 
capable of requiring the data collection and threat assessment requirements on 
international shipping corporations that transport air cargo until they enter the United 
States. Once an explosive device is placed on an American flagged aircraft, the multi¬ 
layered security system has failed. The TSA’s inability to ensure the security of 
international air cargo was highlighted by the successful October 2010 AQAP attack 
printer toner attack. 

B. THE EUROPEAN UNION AIR CARGO SYSTEM 

The goal of the EU regulations is to harmonize the security procedures applied to 
air cargo shipments throughout the European Union while minimizing the threat to EU 
citizens and trade. Similar to the U.S. domestic air cargo system, the European Union has 
created several categories of known and secure shippers as a means of ensuring the 
supply chains levels of security. While some of the processes differ from those applied 
within the United States, the multi-layered security framework used by the European 
Union nearly mirrors that of the United States. 

The first portal available for air cargo and mail to enter into the secure supply 
chain is acceptance by an account consignor, an entity that serves as a gateway for 
packages prior to delivery to a known consignor. Account consignors must provide 
validated business information to the appropriate member state approving authority. Once 
accepted, account consignors are placed into a database and the businesses shipping 
activity is monitored to ensure the facility continues to process air cargo and mail 
consignments appropriately and regularly. If no activity occurs, the account consignor is 
removed from the database and prohibited from processing air cargo and mail 
consignments. As described in the EU air cargo security documents, “The EU security 
regime relating to air cargo is essentially based on two pillars; the secure supply chain 
and the security control of consignments.” 95 


95 European Union, “European Commission-MEMO/lO/545, Air Cargo Security,” May 11, 2010, 
http://europa.eu/rapid/press-release_MEMO-10-545_en.htm. 
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The first layer of security placed over the airmail and cargo supply chain is the 
regulated agent, which is defined as “any entity that applies security controls as referred 
to in point 6.3.2.O.” 96 Member states are required to establish a verifiable approval 
process that allows for the establishment of regulated agents within the member states 
civil aviation security program as outlined in Article 10 EC 300/2008. Companies that 
forward and haul freight are required to meet and certify compliance with the strict 
training and documentation standards imposed by the EC 300/2008. These regulatory 
mandates require enhanced training standards, and as in the United States, background 
checks for employees are similar to TSA’s STA process. As a result, those companies 
that produce cargo and are capable of meeting these standards are then recognized as a 
known consigner, which exempts the company from additional security screening when 
providing air cargo to a regulated agent for transportation on air passenger and all air 
cargo aircraft. 97 This process is illustrated in the below figure which provide a visual 
depiction of the European Union 3 ld country security processes. 


9(1 Official Journal of the European Union, Commission Regulation (EU) N. 185/2010 , March 4, 2010. 
97 European Union, '‘European Commission-MEMO/lO/545, Air Cargo Security.” 
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Figure 6. European Union 3rd County Airport Process 98 


Unlike within the United States, the European Union does not have a singular 
police mechanism beyond the member states’ borders, with the exception of International 
Criminal Police Organization (INTERPOL), whose mission is to provide help and 
guidance to law enforcement organizations by providing investigative training and 
guidance, as well as secure communication and communication channels. 99 All other 
intelligence and criminal investigative responsibilities fall to the member states’ military, 
border police, or national police. Each member state is responsible for providing funding 
and operational guidance to these law enforcement organizations and often allocates 


98 Directorate General for Internal Policies, The EURegulatory Framework Applicable to Civil 
Aviation Security, 2011. 

99 Interpol, “Organization Overview and Mission,” n.d., http://www.interpol.int/About- 
INTERPOL/Overview. 
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operation resources based upon the threat guidance provided by the member state’s 
intelligence organization. 100 

In much the same manner that the TSA is limited to regulating air cargo 
operations within the jurisdictional boundaries of the United States, the European Union 
is only capable of enforcing its jurisdictional authority on those countries members of the 
European Union, which is at an additional disadvantage when it comes to law 
enforcement and intelligence operations. Each EU member state of is solely responsible 
for law enforcement and intelligence operations within those states borders. While the 
TSA as a federal organization within the United States has the authority to mandate the 
coordinated dissemination of threat information, member states within the European 
Union are only required to follow and implement EU regulations within their means and 
capabilities and may “derogate from the common standards to adopt alternative measures 
providing an ‘adequate’ level of aviation security.” 101 The European Union has the right 
to conduct civil aviation inspections as a means of ensuring regulatory compliance by the 
member state. As highlighted in the U.S. system, compliance to the air cargo regulatory 
framework is limited to members of the European Union, which is incapable of enforcing 
these regulatory requirements on non-members that participate in the air cargo industry. 

C. THE PROPOSED AIR CARGO POLICY CHANGE 

It is recommended that the TSA, in combination with CBP, use the Department of 
State’s (DOS) Intelligence and Threat Analysis (ITA) sections protocols as the basis for a 
first level evaluation of risk for air passenger and all cargo aviation shipments. Since 
industry and employee data cannot be gathered as a means of conducting a STA, the DOS 
ITA can serve as a vital bridge between the DOS and the IC by producing real time 
country level threat and trend analysis. The ITA is able to produce this analysis through 
the creation and administration of the Security Environment Threat List (SETL), which 


100 U.S. General Accounting Office, Report to Congressional Requesters, Combating Terrorism, How 
Five Foreign Countries Are Organized to Combat Terrorism. 

101 Directorate General for Internal Policies, The EU Regulatory Framework Applicable to Civil 
Aviation Security. 
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provides an analytical view of four threat and security categories. 102 Two of the products 
provided to the public include DOS travel alerts designed to provide security guidance to 
travelers, and travel warnings designed to provide real time threat infonnation to citizens 
about products that detail security threats and travel restrictions to the American public. 
A similar process should be developed in conjunction with the DOS that would allow for 
regional and country specific threat categorization that could be applied to air cargo 
departing identified threat countries. This initial evaluation would provide an opportunity 
to ensure high-risk cargo is prevented from transport on air passenger aircraft or all air 
cargo aircraft at the point of origin or that a verifiable enhanced screening technique is 
applied to authorize the transport of air cargo from the threat region is authorized on air 
passenger and air cargo aircraft. 


102 U.S. Department of State, Diplomacy in Action, “Intelligence and Threat Analysis,” 2013, 
http://www.state.govv/rn/ds/terrorism/c8584.htm. 
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VI. JURISDICTIONAL HURDLES 


The difficulty with coordinating transnational terrorism investigations and 
operations has been well documented in the media, government reports, and academic 
publications. The Wall Street Journal focused on these difficulties in an 2010 article that 
detailed the security gaps and used the below illustration to highlight the international 
security failures. This chapter focuses on the implementation issues faced by the TSA as 
it pertains to verifying and enforcing the implementation of the 100 air cargo-screening 
requirement. The established processes of the United States and the European Union is 
discussed and each system’s capabilities and limitations are explored. Additionally, a 
discussion of the possible difficulties and benefits of implementation of the proposed 
system are evaluated. 


Weak Links in the Cargo Chain 



SHIPPERS 

The Transportation Security Admin¬ 
istration relies on 'trusted shippers' 
to screen cargo before it gets on an 
aircraft 

There are four methods approved 
by the TSA: 

I Explosives detection 
I X-rays 

I Physical inspections 
I Inspections by canine teams 



100% of all cargo on U.S. domestic and international 
passenger flights departing from the U.S. is now 
being screened. 



Weak point: 

There's no approved technology 
to screen cargo once it is loaded 
on the pallets used to ship 
cargo in wide-body aircraft. 

That makes up 75% of 
passenger plane cargo. 


Weak points: 

Only about three-quarters of the cargo that currently 
arrives in the U5. each day in foreign passenger jets 
is screened or randomly inspected for explosives 

Among all cargo aircraft, the amount of shipments 
screened before they touch down in the U S. may be 
as low as 50%. according to industry professionals. 


Figure 7. Weak Links in the Air Cargo Chain 103 


103 Andy Pasztor, Keith Johnson, and Daniel Michaels, “Focus on Cargo Security Steps,” The Wall 
Street Journal, November 1, 2010, http://online.wsj.eom/article/SB1000142405274870370840457558 
6811087404960.html. 
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A. 


THE U.S. AIR CARGO SYSTEM 


According to the Implementing the 9/11 Commission Recommendations Act of 
2007, all air cargo transported on passenger aircraft is required to receive security 
screening at a level commensurate with the screening provided to passenger baggage. In 
accordance with the Implementing Recommendations of the 9/11 Commission Act of 
2007, the 100 percent screening process for domestic cargo on passenger aircraft was to 
be completed by August 2010. The TSA, through ATSA, is tasked with regulating the 
screening of passengers and cargo. 104 This requirement is further codified in 49 CFR Part 
1542—Airport Security, which outlines the regulatory relationship between the TSA and 
airport operators. 105 To meet this requirement, the TSA developed and implemented a 
layered security methodology for the vetting and screening of domestic and international 
cargo shipments in the air cargo supply chain. The goals of these programs are detailed in 
the TSA Air Cargo Strategic Plan, which states the priorities as: 1) enhancing supply 
chain and shipper security, 2) identifying elevated risk cargo through pre-screening, 3) 
identifying technology for performing targeted inspections, and 4) securing all-cargo 
aircraft through the appropriate application of security measures. 106 Cargo operations are 
regulated under 49 CFR Part 1544.205—Acceptance and Screening of Cargo, which 
states that aircraft operators are responsible for preventing the carriage of explosives in 
cargo onboard aircraft and how this should be accomplished. 107 

As for international air cargo security, since the TSA has no authority to place 
regulatory restrictions upon the foreign nation’s shippers as a means of securing the air 
cargo supply chain, enforcement of the 100 percent air cargo screening requirement has 
been difficult. As a means of bridging this gap, the TSA has signed agreements with the 
European Commission, Canada, Australia, and the member states of the European Union. 
The goal of these agreements is to close the gap in international practices by hannonizing 

104 Govytrack.us., “S. 1447 (107th): Aviation and Transportation Security Act.” 

105 U.S. Government Printing Office, “49 CFR Part 1542-Airport Security.” 

106 Transportation Security Administration, Cargo Security Sensitive Security Identification Guide, 
SSIIDG 0050 Version 1.0, May 2007. 

107 U.S. Government Printing Office, “49 CFR Part 1544.205-Aircraft Operator Security: Air Carriers 
and Commercial Operators.” 
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the air cargo security practices beyond U.S. borders. The TSA states on its air cargo 
frequently asked questions website, “this harmonization will greatly contribute to 
achieving the 100 percent screening requirement of the 9/11 Act.” 108 These agreements 
were necessary because, as stated by the Honorable Charles W. Dent from Pennsylvania 
during his June 30, 2010 Congressional testimony, “International enforcement is, very 
frankly, impossible.” and despite this proclamation went on to say, “as the Ranking 
Member of the subcommittee that oversees TSA, I am going to ensure compliance with 
the law.” 109 Despite the industries’, governments’ and congressional acknowledgment of 
the improbability of a successful execution of the 100 percent air cargo screening 
protocol, the requirement continues to exist. 

The TSA’s alternative plan for resolving the jurisdictional conflicts associated 
with international compliance is dependent on raising the airlines screening requirements 
while continuing to work with foreign governments to create and certify compliant air 
cargo screening capabilities and inspection processes. 110 While within the United States 
the TSA is able to enforce air cargo screening requirements through the employment of 
TSI-C, enforcement operations and inspections outside of the TSA’s jurisdiction, is 
dependent on the responsible governments and associated agencies. 111 As a result of 
these jurisdiction difficulties, John Meenan, the Chief Operating Officer of the Air 
Transport Association, stated in his congressional testimony that “the most practical 
approach internationally rests with the approval of government-to-government 
compatible security programs.” 112 Multinational collaboration and cooperation is always 
difficult to accomplish in an open trade environment. This issue additionally includes the 
necessity to gain and verify regulatory compliance from domestic and foreign air carriers, 
as well as the governments of foreign countries. The review and acceptance of air carrier 
security programs dates as early as 1990 when the Presidential Commission on Aviation 

108 Transportation Security Administration, “Frequently Asked Questions.” 

109 Dent, “100 Percent Air Cargo Screening: Remaining Steps to Secure Passenger Aircraft, Flearing 
before the Subcommittee on Transportation Security and Infrastructure Protection.” 

110 Ibid. 

111 Ibid. 

112 Ibid. 
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Security and Terrorism first explored and addressed the issue in the wake of the attack on 
Pan Am flight 103. 113 Despite the continued effort to harmonize security processes and 
procedures internationally, enforcement and regulation continue to prevent an 
administratively acceptable solution. 

B. THE EU AIR CARGO SYSTEM 

The EU regulatory framework applies to all its member states and is updated 
regularly to ensure the member states’ ability to address evolving risks and threats. 114 As 
such, these member states are required to ensure the security of flights departing their 
territories. In response to the attacks on 9/11, the European Union passed regulation 
2320/2002 that established the EU’s aviation security goals. As stated in 2320/2002, “The 
main objective of this Regulation is to establish and implement appropriate Community 
measures, in order to prevent acts of unlawful interference against civil aviation.” 115 
Furthermore, the European Union established Commission Regulation (EC) No 622/2003 
on 4 April 2003, which establishes measures for the implementation of the common basic 
standards on aviation security, the majority of which are appropriately classified at the 
secret level. 116 Just as 49 CFR 1550 established the authority of the TSA to regulate 
aviation within the United States, EC 622/2003 was designed to “lay down the necessary 
measures for the implementation and technical adaptation of common basic standards 
regarding aviation security to be incorporated into national civil aviation security 
programs.” 117 As the aviation industry and associated regulatory organization began to 
focus on preventing dangerous and hazardous cargo from being transported on air 
passenger aircraft, the EU Council published EC 831/2006 that states: 


113 PolicyFutures, “Report of the Presidents Commissions on Aviation Security and Terrorism,” 34. 

114 Directorate General for Internal Policies, The EU Regulatory> Framework Applicable to Civil 
Aviation Security. 

115 Official Journal of the European Union, “Commission Regulation (EC) No 2320/2002 of 16 
December 2002,” 2002, http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2002:355:0001: 
0021:EN:PDF. 

116 Official Journal of the European Union, “Commission Regulation (EC) No 622/2003 of 4 April 
2003.” 

117 Ibid. 
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(3) As regards the measures for the implementation of the standards on 
airline materials and on cargo, courier and express parcels, the content of 
Regulation (EC) No 622/2003 should be revised in the light of experience 
gained. 118 

Similar to the process employed in the United States by the TSA, the European 
Commission is responsible for the monitoring of the member states to ensure compliance 
with the regulation. 119 This monitoring is accomplished with unannounced regulatory 
inspections and enforcement operations. Member states are required to comply with the 
inspections and to make auditors available for participation in the inspection. As with the 
TSA, when it comes to third-country shippers, the European Union also does not have the 
necessary regulatory authority to require compliance with the EU regulations. As a result, 
the European Union seeks cooperation from third countries through the acceptance of 
security practices and standards as way to “facilitate air transport and contribute to the 
objective of ‘on-stop-security’” by recognizing “the equivalence of aviation security 
standards of third countries.” 120 Similar to the concerns faced by the United States, when 
it comes to accepting the process and procedures of a foreign nation, the European Union 
does not have the capability to regulate or enforce security protocols outside its 
jurisdictional boundaries, which hinders the ability to verify the acceptability of the third- 
countries protocols. 

C. THE PROPOSED AIR CARGO POLICY 

Unfortunately, no good solutions are available to the jurisdictional gaps that exist 
at the point in which international trade and government regulation intersect. The 
proposed system of evaluating international air cargo is no different from the EU or the 
U.S. system in this shortcoming. The ability of a foreign country to attempt to enforce its 
regulatory authority upon a secondary country is simply implausible. Without the ability 


118 Official Journal of the European Union, “Commission Regulation (EC) No 831/2006 of 2 June 
2006,” 2006, http://eurlex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2006:l50:0004:0005:EN:PDF. 

119 European Parliament, “The EU Regulatory Framework Applicable to Aviation Security,” 2011, 
http://www.eroparl.europa.eu/studies. 

120 Ibid. 
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to impose fiscal or operational penalties on the regulated industry or country, the 
authority of the regulating agency is significantly diminished. 

The one possible solution to a failure of a foreign country to comply with the 
screening requirements that could be imposed is that used by CBP when passengers are 
brought into the United States without the appropriate visas or authorizations. CBP 
regularly requires international air carriers to pay for the cost of returning foreign 
nationals to their point of departure if they arrive in the United States without the proper 
documentation, visas, or authorizations. Applying this process to air cargo that arrives in 
the United States without having been appropriately screened prior to departure from the 
point of origin would provide a fiscal incentive for the air carrier to ensure the 
appropriate processes and procedures were followed prior to transport. While not an 
effective prevention or detection solution, it does provide a fiscal motivation for the 
airline to comply with the screening protocols. 
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VII. AIR CARGO SECURITY SYSTEM COSTS 


Many hurdles to the implementation of a 100 percent air cargo screening protocol 
exist. One of the most often cited and documented hurdles noted in government and 
industry reports are the costs associated with this requirements implementation. The 
application of this process in an international environment further exacerbates the costs 
associated with its implementation because of the varied protocols, technologies, and 
capabilities in the affected countries. The journal of the European Union used the below 
scales of justice as a means of providing a visual depiction of the trade offs associated 
with increased security and the effects these increases have on trade. This chapter 
explores the projected costs associated with the implementation of the 100 percent air 
cargo screening protocol for the United States and the European Union, and the projected 
savings of implementing a risk-based intelligence driven system. 


Security 

Threats 

• Explosives and Incendiary 
devices 

• Hazardous materials 

• Cargocrlme 

• Sabotage 

Measures 

• Screening 

• Inspections 

• Training 

• Validation 

• Reporting 



Economy 

• EU imports by air from 
non-EU -€220.8bn 
(2009) 

• EU exports by air from 
non-EU-€289.3bn 
(2009) 

• 35% Increase In air 
frelg ht transport from 
1997 to 2007 

• 5.2% forecasted 
worldwide growth of air 
cargo over next 20 years, 
measured by revenue 
tonne-km 


Figure 8. Security Costs and Economic Impact 121 


A. THE AIR CARGO SYSTEM 

The air cargo industry is designed to provide fast and efficient transportation of 
consumer products across the global supply chain. Since the air cargo industry is such a 


121 Official Journal of the European Union, “Commission Regulation (EC) No 1802/2012 of 9 
November 2012,” 2012, http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2012:324: 
0025:0049:EN:PDF. 
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diverse organization that regularly crosses international boundaries, it is difficult to 
accurately assess the economic impact the 100 percent air cargo screening requirement 
will have on the affected economies and the industry. It is further more difficult to 
separate the economic impact the mandate will have on both the U.S. and EU economies 
without discussing them simultaneously. Instead of attempting to accomplish this task, 
this chapter examines the cumulative impact the regulatory change will have on the 
economies and industry concurrently. 

In 2011, air cargo merchandise transportation accounted for an estimated 
$424,265 million in U.S. exports and $493,038 million in U.S. imports. 122 
Comparatively, the European Union had air trade imports valued at 292.1 billion euros 
and exports valued at 362 billion euros during 20 1 0. 123 In 2010, air passenger aircraft 
operators alone transported an estimated 3.6 billion pounds of air cargo to the United 
States from foreign points of origin. 124 In testimony before Congress in 2010, John 
Sarnmon, Assistant Administrator of TSA, stated that an estimated “2.8 billion pounds of 
air cargo arrives on passenger aircraft from 94 different sovereign nations annually via a 
global air cargo supply chain with a vast number of participants.” 125 Anytime a universal 
requirement is placed on such a vast and complex industry that contains such a 
widespread group of stakeholders, it is difficult to predict the unintended costs and 
consequences. 

The implementation of the 100 percent air cargo security screening mandate cost 
was estimated by the Center for American Progress in a 2007 study to be at least 
$600 million annually for the air cargo shipping industry. According to the International 

122 Vivian C. Jones and Marc R. Rosenblum, U.S. Customs and Border Protection: Trade 
Facilitation, Enforcement and Security, CRS Report R43014 (Washington, DC: Library of Congress, 
Congressional Research Service, March 22, 2013), 39. 

123 Official Journal of the European Union, “Commission Regulation (EC) No 1802/2012 of 9 
November 2012,” 9. 

124 U.S. Government Accountability Office, Report to Congressional Requesters, Aviation Security, 
Actions Needed to Address Challenges and Potential Vulnerabilities Related to Securing Inbound Air 
Cargo (GAO-12-632), Washington, DC: GPO, 2012, http://www.gao.gov/products/GAO-12-632. 

125 John Sammon, “100 Percent Air Cargo Screening: Remaining Steps to Secure Passenger Aircraft. 
Hearing before the Subcommittee on Transportation Security and Infrastructure Protection,” 2010, 
http://www.gpo.gov/fdsys/pkg/CHRG-l 1 lhhrg64699/html/CHRG-l 1 lhhrg64699.htm. 
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Air Cargo Council, imposing the 100 percent air cargo screening mandate creates 
“additional cost burdens on the U.S. economy, negatively impacting businesses—both 
small and large—with the establishment of cargo security and inspection protocols that 
rely on unproven technologies and that do not insure security improvements that are 
commensurate with the expenses incurred.” 126 In 2007, TSA spokeswoman Andrea 
McCauley estimated that the 10-year cost of implementing the 100 percent air cargo¬ 
screening mandate would be approximately $3.6 billion while a CRS analysis similarly 
placed the implementation costs at approximately $3.7 billion over the same 10-year 
period. 127 In his 2007 testimony before the subcommittee on transportation, Pennsylvania 
Congressman Charles Dent discussed the cost of the 100 percent air cargo-screening 
mandate when he said the measure “placed an expensive and burdensome mandate 
without adding any tangible security benefit.” 128 

The application of the 100 percent air cargo screening protocol also creates 
government costs. As early as 2001, the FAA conducted an analysis to detennine the 
feasibility and cost of screening all passenger air cargo. The FAA analysis determined 
that to accomplish the 100 percent passenger air cargo screening goal, 8000 federal air 
cargo screeners would be required, and a budget of $500 million would be necessary to 
create the cargo inspection program. Today, the TSA’s Transportation Sector Network 
Management Air Cargo Divisions 2011 budget was $115 million. These funds were used 
to support air cargo inspections, explosive canine operations and the National Explosives 
Detection Canine Program. 129 In Senate Report 112-074, which details the appropriations 
for TSA’s security programs, the 112th Congress allocated $120,654,000 for air cargo 


126 Perry Trunick, “Opposition Gathers to H.R. 1 Security Regulations,” Material Handling & 
Logistics, 2007, http://mhlnews.com/transportation-amp-distribution/opposition-gathers-hr-l-security- 
regulations. 

127 Bart. Air Cargo Security. 

128 Dent, “100 Percent Air Cargo Screening: Remaining Steps to Secure Passenger Aircraft. Hearing 
before the Subcommittee on Transportation Security and Infrastructure Protection.” 

129 U.S. Government Accountability Office, Report to Congressional Requesters, Aviation Security, 
Actions Needed to Address Challenges and Potential Vulnerabilities Related to Securing Inbound Air 
Cargo, 11. 
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security activities. 130 This number represented a 6,000,000 dollar increase beyond the 
funds requested which represented targeted funding designed to secure all air cargo 
aircraft and facilities, as well as international air cargo being transported on inbound air 
passenger aircraft. Similar to the government and industry analysis and projected costs 
that have been broadly discussed and cited regarding the U.S. implementation of the 100 
percent air cargo security requirement, the EU’s implementation process faces 
comparable costs and challenges. In an EU Commission sanctioned report on the 
implementation of the new screening requirements, an analysis of the incurred costs 
based upon the percentage of cargo screened determined that at a 45 percent screening 
level assuming a .025 Euros surcharge per kilo, the accumulated screening cost would be 
38.3 million Euros. 131 A surcharge of .05 would raise the estimate to 85.3 million Euros. 
Additionally, the initial cost for the training and certification of 166 EU aviation security 
validators would be approximately 1.5 million Euros. 132 The report continued to note that 
if the number were raised to 401 EU aviation security validators, the cost would jump to 
2.8 million Euros. 133 

The balance between security and an unencumbered industry is a difficult 
pathway to navigate. Determining at what point the cost of a process exceeds the benefit 
the added security provides has been a source of debate and analysis within the 
government and media since the attacks on 9/11. In the final analysis, the critical question 
that needs to be answered is whether the use of 100 percent air cargo security screening, 
which carries a significant number of negative cost implications, is justified by the 
greater impregnability of the international air cargo supply chain. 134 While the 
tremendous volume of air cargo combined with the significant negative economic impact 

130 The Library of Congress Thomas, “Committee Reports, 112th Congress (2011-2012) Senate 
Report 112-074,” http://thomas.loc.gov/cgLbin/cpquery/?&sid=cpll25c4Ad&r_n=sr074.112&db 
name=cpl 12&&sel=TOC_236142&. 

131 Official Journal of the European Union, “Commission Regulation (EC) No 1802/2012 of 9 
November 2012,” 7. 

132 Ibid. 

133 Ibid. 

134 Policy Research Corporation, The Impact of 100 percent Scanning of U.S. Bound Container on 
Maritime Transport, Final Report, 2009. 
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an attack on the global air cargo supply chain would have on the U.S. and European 
economies requires the pursuit of an improved air cargo security solution, the greater 
question is if the cost of implementing a 100 percent air cargo screening requirement is a 
fiscally responsible solution. 

B. THE PROPOSED AIR CARGO POLICY 

The proposed system seeks to apply known and readily available programs, 
systems, and data streams to what are today a splintered international air cargo security 
process with separate requirements within multiple agencies. While costs will certainly 
be associated with the implementation and integration of these systems, the burden of the 
costs will not be associated with instituting new and untested systems, technologies, and 
regulatory requirements. The current 100 percent air cargo security screening protocol 
process places the cost on the shoulders of the aviation and shipping industries. Assuming 
a risk-based intelligence driven system has the ability to reduce the required 100 percent 
air cargo screening by 50 percent, and using the Center for American Progress 2007 
study of the air cargo shipping industry costs for implementing a 100 percent air cargo 
screening requirement, the proposed system has the capability to save the air cargo 
industry approximately $300 million annually. 135 0ver a decade, the possible reduction 
in screening of low risk cargo has the ability to translate into a 1.5 billion dollar savings 
using the TSA’s and CRS’s 10-year cost estimates for the current system. 136 The greater 
benefit will be the cost savings realized by the efficient use of enforcement and 
regulatory assets. While the current system will require that all air cargo be treated 
equally, the proposed system looks to target those air cargo shipments that pose the 
greatest threat to the aviation industry by assessing the risk of the shipment, shipper, 
region, and the aircraft type, and then applying the appropriate threat and security level to 
the item that then allows security and law enforcement specialists to require or reduce the 
screening requirement to ensure the appropriate use of the limited security assets. 


I 33 P. J. Crowley and Bruce R. Butterworth, “Keeping Bombs off Planes, Securing Air Cargo, 
Aviation’s Soft Underbelly,” Center for American Progress, May 2007, http://www.americanprogress.org/ 
issues|/2007/05/pdf/air_cargo.pdf. 
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VIII. RECOMMENDATIONS AND CONCLUSIONS 


A. ADOPTION OF A RISK BASED INTELLIGENCE DRIVEN AIR CARGO 

SCREENING PROTOCOL 

For the TSA to move towards a risk-based intelligence driven air cargo screening 
operation, a shift from the 100 percent screening model and mandates must be made. 
CBP has historically conducted risk-based and intelligence driven passenger and cargo 
operations out of the National Targeting Center (NTC). Additionally, the TSA regularly 
applies risk-based strategies to domestic and international passenger air travel through the 
use of interagency operations at the NTC and risked-based security initiatives, such as 
TSA Pre/, the under 12 and over 75 modified screening procedures, and the Know 
Crew Member Database, while maintaining a security randomization process that ensures 
no passenger is exempt from the possibility of the full security protocols as outlined in 
the ATS A. TSA’s Kenneth Fletcher provided the below depiction of a risk based 
passenger screening process in his thesis which argued for the implementation of such a 
protocol as a means of more efficiently and effectively screening passengers in the 
aviation domain. 
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Figure 9. Risk-Based Screening 137 


The proposed policy change is designed to create a base line from which the 
program can be established and then expanded. Each tier in the process is used as a threat 
screening method with the goal of separating the cargo that poses the greatest real or 
perceived threat from the cargo that poses a lower threat to aviation. This process does 
not require the physical screening of the cargo but rather is a data driven procedure that 
allows for the rapid separation of cargo into distinct threat levels. Each threat grouping is 
then subject to the necessary level of physical or administrative screening as opposed to 
the now required 100 percent screening mandate. 

The tiers are not meant to remain as a static screening mechanism. The intent of 
the tiered system is to allow each grouping to be adjusted based on a risk- and threat- 
based intelligence system. Each tier can be rapidly adjusted and adapted to the threat and 
risk associated with regions, periods of heighten awareness, or parcel types. While the 


137 Kenneth Fletcher, “Aviation Security: A Case for Risk-Based Passenger Screening” (master’s 
thesis, Naval Postgraduate School, 2011), http://www.hsdl.org/?view&did=699603. 
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initial policy includes a three-tiered system, it should be seen as a static part of the policy. 
The process was developed with the intention of creating a flexible, adaptable, and 
sustainable screening system. If mores tiers are required to ensure the proper screening of 
air cargo, they should be added. Additionally, once a tier is added, it is not necessary to 
keep that tier indefinitely. If the tier has served it purpose, and is no longer needed 
because a threat period has passed, then when appropriate, it should be removed. 

1. Tier One 

It is recommended that the TSA and CBP use the DOS’s ITA sections protocols 
as the basis for a first level evaluation of risk for air passenger and all cargo aviation 
shipments. The DOS ITA serves as a vital bridge between the DOS and the IC, which 
produces real time threat and trend analysis. The ITA creates and administers the SETL, 
which provides an analytical view of four threat and security categories. 138 Two products 
provided to the public include DOS travel alerts designed to provide security guidance to 
travelers, and travel warnings designed to provide real time threat information to citizens 
in products that detail security dangers and travel restrictions to the American public. A 
similar process should be developed in conjunction with the DOS that would allow for 
regional and country specific threat categorization that could be applied to air cargo 
departing threat countries. This initial evaluation would provide an opportunity to ensure 
high-risk cargo is prevented from transport on air passenger aircraft, or all air cargo 
aircraft or that verifiable enhanced screening techniques are applied to authorize the 
transport of air cargo from the threat region on air passenger and air cargo aircraft. 

2. Tier Two 

The TSA and CBP would continue to conduct assessments of domestic and 
international cargo facilities for regulatory compliance and would retain administrative 
oversight of these public entities. The TSA would ensure domestic compliance of 
shippers with 49 CFR 1542 (Airport Security Regulation), 1544 (Domestic Aircraft 
Operator Regulation), and 1546 (Foreign Air Carrier Security), which detail the process 


138 U.S. Department of State, Diplomacy in Action, “Intelligence and Threat Analysis.” 
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for compliance with the aircraft operator standard security program, the model security 
program, and airport security programs that detail the processes necessary to comply with 
the federal regulations pertaining to aviation operations. The TSA and CBP would 
continue to evaluate the value of the air cargo strategic plan and ACAS pilot program that 
applies established threat-based risk management protocols to aviation cargo security 
operations. Additionally, the TSA should expand the known shipper program beyond the 
400,000+ voluntary participants creating a mandatory participation protocol, which 
would allow for an increased visualization of air cargo security operations and data 
collection. The larger the data available for analysis, the stronger the program will 
become. Effective data collection and analysis can be best accomplished by making a 
concerted effort to increase the population base available. Efforts should be increased to 
improve industry participation in this portion of the process. 

3. Tier Three 

Two classes of air cargo should be created. The TSA and CBP should 
differentiate the threat posed by a screening failure in air cargo on passenger aircraft and 
air cargo on all air cargo or all airmail aircraft, as is done in by EU Commission 
Regulation No 185.2010. The implementation of a risk- and consequence-based security 
protocol is consistent with the pending Quadrennial Homeland Security Review. A risk 
and consequence application, which is based on the impact of an attack on each mode of 
transportation, would provide the balance desired by industry leaders and the flexibility 
sought by the governing officials. Of particular note in EU Regulation No 185/2010 is the 
designation of cargo secure for passenger, all-cargo, and all-mail aircraft, and the 
distinction of cargo secure for all-cargo and all-mail aircraft only, based on a known 
consignor and the means or method of screening, which allows shippers the ability to 
adjust screening process dependent on the method of transport required. This 
differentiating methodology is absent in the TSA and CBP processes. The ability to 
distinguish the consequence level based on passenger aircraft versus the all air cargo and 
mail aircraft is a significant advantage for the European Union as opposed to the all 
threats all consequence inclusive system the United States uses under the current 100 

percent air cargo security screening congressional mandates. 
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A group within the NTC should be created with the goal of developing a risk- 
based screening protocol that would combine the numerous and overlapping programs 
that currently exist separately within the TSA and CBP while continuing to meet the 
goals and mandates of each agency. This group would additionally be tasked with 
creating a unified air cargo security plan and protocols. The application of joint 
operations and analysis, a risk- and consequence-based targeting system will allow for an 
extensive and multi-dimensional assessment of air passenger cargo and all air cargo 
aircraft in the global supply chain to limit terrorist and criminal organizations from 
capitalizing on the identified weaknesses in these systems. 

The TSA and CBP should formally combine cargo security targeting and 
screening operations while seeking to have Congress shift the mandated operational 
emphasis away from the 100 percent screening mandate and move towards a risk- and 
consequence-based screening protocol that would provide a flexible, adaptable, resilient, 
sustainable, and balanced process that protects industry and customer interests while 
ensuring a secure domestic and international air cargo supply chain. 

B. CHALLENGES TO IMPLEMENTATION 

The global supply chain is a complex and continuously evolving entity that makes 
it difficult for a single agency with limited resources to ensure its security. A combined 
effort to secure air cargo by the TSA and CBP could provide the depth of experience and 
breathe of resources necessary to improve the current system, which is both cumbersome 
and duplicative. A combined risk-based intelligence driven air cargo security effort 
would best accomplish the goals and mandates of the Aviation Transportation Security 
Act of2001 and the Implementing Recommendations of the 9/11 Commission Act of2007. 
The problem has been recognized and well documented in govermnent reports and 
testimony, as well as in industry trade journals. 

Prior to and after 9/11, the GAO and CRS conducted numerous inquiries into the 
air cargo supply chain and have generated voluminous reports that have identified the 
scope of the issue, the failures, and the successes of both the TSA’s and CBP’s air cargo 
screening. As a result of this failure, several process groups have been created within the 
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TSA and CBP that include foreign counterparts and industry leaders in the global supply 
chain. In each instance, the focus has been on the need for collaboration and industry 
participation to meet the 100 percent air cargo screening congressional mandates despite 
the universal agreement that such a process is cumbersome and inefficient. 

In 2009, CBP and the TSA created a working group with the intent of determining 
the feasibility of using CBPs ATS to support the cargo-screening mission of the TSA. 
Following the 2010 air cargo attack, the working group’s activities were accelerated and 
a voluntary pilot program was established to determine the feasibility of a combined 
cargo security effort between CBP and the TSA. 139 To date, the ACAS pilot, which was 
extended this past April, has been used to evaluate 14 million shipments in the express 
segment of the air cargo system by using available data and shipper information. 140 
Although progress has been made, the system remains voluntary and still does not cover 
all segments of the air cargo supply chain, and as a result, both agencies failed to detect 
the 2010 Yemen air cargo attack. 

For the TSA to move towards a risk-based intelligence driven air cargo screening 
operation, a shift from the congressionally mandated 100 percent screening model would 
be necessary. This hurdle will require a repeal or modification of the legislation that 
mandates this requirement, which will be difficult but not impossible. As previously 
noted, the TSA is implementing robust risk-based passenger screening protocols. The 
move from the 100 percent all threat passenger-screening protocols provides an 
opportunity for the evaluation of the necessity and feasibility of the 100 percent air cargo 
screening processes. The 100 percent air cargo security screening protocols continue to 
be developed despite the compelling industry and govermnental testimony citing the 
fiscal and jurisdictional obstacles and infeasibility of applying such a regimented system 
of security. An alternative solution to this problem is to both redefine the screening 
process and to combine the resources of CBP and the TSA in the ACAS system. This 

139 Department of Homeland Security, “Air Cargo Advance Screening (ACAS) Pilot,” CBP.gov, 
August 2011, http://www.cbp.gov/xp/cgov/trade/cargo_security/cargo_control/acasp_faq.xml. 

140 Transportation Security Administration, “Air Cargo 2012 Spring Conference, TSA Administrator 
John S. Pistole, Remarks As Prepared for Delivery, Air Cargo 2012 Spring Conference, Miami, Florida, 
March 20, 2012,” March 20, 2012, http://www.tsa.gov/press/speeches/air-cargo-2012-spring-conference. 
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process, in addition to the three-tiered system previously described, can be used to meet 
the requirements imposed by the congressionally mandated 100 percent screening 
protocol while eliminating the need to physically inspect all air cargo. 

CBP has historically applied risk-based strategies to international passenger air 
travel through joint operations at the NTC, and the TSA has moved towards a more 
efficient risk-based screening process, which allows each agency to allocate the defined 
and limited resources properly that have become the reality of the currently restricted 
government operations cycle. 

C. LIMITATIONS OF THE RESEARCH 

This project was begun as a means of determining the possibility of applying a 
risk-based intelligence driven international air cargo screening protocol to the transport of 
international air cargo to help secure the aviation industry and passengers in light of the 
successful attack on air cargo aircraft by AQAP in November 2010. As a means of 
accomplishing this task, an analysis of the polices of the United States and the European 
Union was conducted to detennine the best policy and process for securing this specific 
section of the aviation environment. Numerous program and polices were reviewed to 
include the TSA’s risk based screening, the TSA and CBP ACAS pilot program, and the 
European Union’s regulatory approach to aviation security. 

As a means of ensuring the widest dissemination possible, this research project 
did not include the review of classified or sensitive security information, as this inclusion 
would have significantly limited the ability of the information to be viewed and analyzed 
by a wider audience. The intention of this project was to advance the understanding of the 
challenges faced by the aviation industry and the regulating agencies required to provide 
a secure travel and transportation environment, as well as a base line for further research 
to be conducted. 
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